Re: [libvirt-users] unable to add pci network to existing vm

2018-12-10 Thread Laine Stump
On 12/10/18 1:24 PM, daggs wrote:
> Greetings,
> 
> I'm trying to add a virtual nic to an existing and active vm and I'm getting 
> this error:
> error: internal error: No more available PCI slots
> 
> the cmd I'm trying to run is: virsh -c qemu:///system attach-interface 
> --domain router --type bridge --source virbr0 --model virtio --config --live
> 
> the lspci output within the vm is this:
> # lspci
> 00:00.0 Host bridge: Intel Corporation 82G33/G31/P35/P31 Express DRAM 
> Controller
> 00:01.0 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
> Root Port 0 (rev 02)
> 00:01.1 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
> Root Port 0 (rev 02)
> 00:01.2 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
> Root Port 0 (rev 02)
> 00:01.3 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
> Root Port 0 (rev 02)
> 00:01.4 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
> Root Port 0 (rev 02)
> 00:01.5 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
> Root Port 0 (rev 02)
> 00:01.6 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
> Root Port 0 (rev 02)

You have 7 pcie-root-ports...

> 00:1d.0 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI 
> Controller #1 (rev 03)
> 00:1d.1 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI 
> Controller #2 (rev 03)
> 00:1d.2 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI 
> Controller #3 (rev 03)
> 00:1d.7 USB controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI 
> Controller #1 (rev 03)
> 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev 92)
> 00:1f.0 ISA bridge: Intel Corporation 82801IB (ICH9) LPC Interface Controller 
> (rev 02)
> 00:1f.2 SATA controller: Intel Corporation 82801IR/IO/IH (ICH9R/DO/DH) 6 port 
> SATA Controller [AHCI mode] (rev 02)
> 00:1f.3 SMBus: Intel Corporation 82801I (ICH9 Family) SMBus Controller (rev 
> 02)
> 00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (2) I219-V 
> (rev 31)
> 01:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. 
> RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 06)
> 02:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. 
> RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 06)
> 03:00.0 SCSI storage controller: Red Hat, Inc. Virtio block device (rev 01)
> 04:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. 
> RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 06)
> 05:00.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon (rev 
> 01)
> 06:00.0 Ethernet controller: Red Hat, Inc. Virtio network device (rev 01)
> 07:00.0 Unclassified device [0002]: Red Hat, Inc. Virtio filesystem (rev 01)

...and 7 PCIe devices, each taking up one of those root ports.

On a PCIe-based archicture, you can only hotplug a device into a
pcie-root-port (not into the root bus), but you can't hotplug the
pcie-root-port itself. libvirt knows this, and since your guest is
running and has no unused pcie-root-ports, it can't do the hotplug.

If you do the attach-interface command with --config *only* (remove the
--live), libvirt will be able to automatically add the pcie-root-port
that it knows is required. Then you'll just need to shutdown and restart
the guest for the device to be added to the running guest instance (a
simple reboot from the guest is insufficient, you need to fully shut it
down, so that a new qemu process is started)

> 08:00.0 PCI bridge: Red Hat, Inc. QEMU PCI-PCI bridge
> 
> how can I add additional pci entry? I don't mind if I need to edit the xml 
> file and restart the vm, I just don't want to cause the vm not to start due 
> to bad xml or something.
> 
> Thanks,
> 
> Dagg.
> 
> ___
> libvirt-users mailing list
> libvirt-users@redhat.com
> https://www.redhat.com/mailman/listinfo/libvirt-users
> 



pEpkey.asc
Description: application/pgp-keys
___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

[libvirt-users] unable to add pci network to existing vm

2018-12-10 Thread daggs
Greetings,

I'm trying to add a virtual nic to an existing and active vm and I'm getting 
this error:
error: internal error: No more available PCI slots

the cmd I'm trying to run is: virsh -c qemu:///system attach-interface --domain 
router --type bridge --source virbr0 --model virtio --config --live

the lspci output within the vm is this:
# lspci
00:00.0 Host bridge: Intel Corporation 82G33/G31/P35/P31 Express DRAM Controller
00:01.0 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
Root Port 0 (rev 02)
00:01.1 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
Root Port 0 (rev 02)
00:01.2 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
Root Port 0 (rev 02)
00:01.3 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
Root Port 0 (rev 02)
00:01.4 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
Root Port 0 (rev 02)
00:01.5 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
Root Port 0 (rev 02)
00:01.6 PCI bridge: Intel Corporation 7500/5520/5500/X58 I/O Hub PCI Express 
Root Port 0 (rev 02)
00:1d.0 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI 
Controller #1 (rev 03)
00:1d.1 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI 
Controller #2 (rev 03)
00:1d.2 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI 
Controller #3 (rev 03)
00:1d.7 USB controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI 
Controller #1 (rev 03)
00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev 92)
00:1f.0 ISA bridge: Intel Corporation 82801IB (ICH9) LPC Interface Controller 
(rev 02)
00:1f.2 SATA controller: Intel Corporation 82801IR/IO/IH (ICH9R/DO/DH) 6 port 
SATA Controller [AHCI mode] (rev 02)
00:1f.3 SMBus: Intel Corporation 82801I (ICH9 Family) SMBus Controller (rev 02)
00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (2) I219-V 
(rev 31)
01:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 
PCI Express Gigabit Ethernet Controller (rev 06)
02:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 
PCI Express Gigabit Ethernet Controller (rev 06)
03:00.0 SCSI storage controller: Red Hat, Inc. Virtio block device (rev 01)
04:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 
PCI Express Gigabit Ethernet Controller (rev 06)
05:00.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon (rev 01)
06:00.0 Ethernet controller: Red Hat, Inc. Virtio network device (rev 01)
07:00.0 Unclassified device [0002]: Red Hat, Inc. Virtio filesystem (rev 01)
08:00.0 PCI bridge: Red Hat, Inc. QEMU PCI-PCI bridge

how can I add additional pci entry? I don't mind if I need to edit the xml file 
and restart the vm, I just don't want to cause the vm not to start due to bad 
xml or something.

Thanks,

Dagg.

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users


Re: [libvirt-users] Power on and power off code using LIBVIRT

2018-12-10 Thread Daniel P . Berrangé
Re-adding libvirt-users - please don't remove mailing list addresses
when replying.

On Mon, Dec 10, 2018 at 09:42:29PM +0530, Chaithra Sn wrote:
> Thanks Daniel for the reply.
> 
> I want code in python langange.

The 'create' method on the Domain object will start an existing
defined guest. The 'destroy' method will stop a running guest.

> On Mon, 10 Dec 2018 at 7:10 PM, Daniel P. Berrangé 
> wrote:
> 
> > On Mon, Dec 10, 2018 at 02:55:12PM +0530, Chaithra Sn wrote:
> > > Dear Team,
> > >
> > > Please provide the code for power on and power off the VM using Libvirt.
> >
> > Thre's many ways to access / interact with libvirt, so you'll need to
> > specify what language or tool you're trying to use libvirt with.
> >
> > Regards,
> > Daniel
> > --
> > |: https://berrange.com  -o-
> > https://www.flickr.com/photos/dberrange :|
> > |: https://libvirt.org -o-
> > https://fstop138.berrange.com :|
> > |: https://entangle-photo.org-o-
> > https://www.instagram.com/dberrange :|
> >

Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

Re: [libvirt-users] Power on and power off code using LIBVIRT

2018-12-10 Thread Daniel P . Berrangé
On Mon, Dec 10, 2018 at 02:55:12PM +0530, Chaithra Sn wrote:
> Dear Team,
> 
> Please provide the code for power on and power off the VM using Libvirt.

Thre's many ways to access / interact with libvirt, so you'll need to
specify what language or tool you're trying to use libvirt with.

Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users


Re: [libvirt-users] Add trusted CA to libvirt

2018-12-10 Thread Daniel P . Berrangé
On Sat, Dec 08, 2018 at 03:02:22PM +0300, Мозолина, Надежда Викторовна wrote:
> Hello! I am trying to make libvirt trust one more CA. I suppose that when
> libvirt establish connection, it doesn't take into account any system
> trusted CAs. And in /etc/pki/CA according to the tutorial I have only one
> CA installed. How can I add one more trusted CA for libvirt?

The cacert.pem file that libvirt loads is not restricted to a single CA.
That file can contain many CA certificates. Just concatenate all their
PEM format docs together and all will be loaded.

NB, we intentionally do not use any of the system trusted CAs by default.
For non-public facing services, using the default worldwide list of
commcercial CAs offers little to no benefit. In fact it would degrade
security, because as we've seen many times it only takes one rogue public
CA to issues bad certs for a domain. For non-public services like libvirt's
API it is thus preferrable to use a private CA and avoid public CAs's from
the system trusted CA list entirely.

Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

[libvirt-users] Power on and power off code using LIBVIRT

2018-12-10 Thread Chaithra Sn
Dear Team,

Please provide the code for power on and power off the VM using Libvirt.

Last week also I sent some query, but I dint get any response.

Please help me in finding the same.

Thanks & regards,
Chaithra
___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

[libvirt-users] Add trusted CA to libvirt

2018-12-10 Thread Мозолина , Надежда Викторовна
Hello! I am trying to make libvirt trust one more CA. I suppose that when
libvirt establish connection, it doesn't take into account any system
trusted CAs. And in /etc/pki/CA according to the tutorial I have only one
CA installed. How can I add one more trusted CA for libvirt?

Best regards,
Nadezhda Mozolina
___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

Re: [libvirt-users] import qcow with snapshots

2018-12-10 Thread Peter Krempa
On Sat, Dec 08, 2018 at 08:59:31 +0100, Chris wrote:
> All,
> 
> is it possible to create a new KVM machine from an existing qcow (v3)
> image with snapshots? snapshot-list doesn't show them, when using
> virt-manager 1:1.5.1-0ubuntu1.1 to create the machine. 
> 
> * t-ad5.img: QEMU QCOW Image (v3), 42949672960 bytes
> 
> chris@cd:/data/md0$ qemu-img snapshot -l t-ad5.img 
> Snapshot list:
> IDTAG VM SIZEDATE   VM CLOCK
> 1 pre-domain0 2018-05-08 21:27:40   00:00:00.000
> 
> chris@cd:~$ virsh snapshot-list t-ad5
>  Name Creation Time State
> 

Currently we don't support so-called 'snapshots without (libvirt)
metadata'. We do support though creation of the metadata in libvirt
without actually invoking any qemu command.

You can use virsh snapshot-create --redefine flag for it. The snapshot
XML needs to have the same name as the qcow2 image's name.

Note that some stuff might not work properly if you don't add a domain
state XML which describes the hardware at the time the snapshot was
taken. (A workaround would be to create a snapshot with the desired
configuration with libvirt, then dump it and modify the name).

Peter


signature.asc
Description: PGP signature
___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

Re: [libvirt-users] concurrent migration of several domains rarely fails

2018-12-10 Thread Lentes, Bernd


Jim wrote:
>> 
>> What is meant by the "admin interface" ? virsh ?
> 
> virsh-admin, which you can use to change some admin settings of libvirtd, e.g.
> log_level. You are interested in the keepalive settings above those ones in
> libvirtd.conf, specifically
> 
> #keepalive_interval = 5
> #keepalive_count = 5
> 
>> What is meant by "client" in libvirtd.conf ? virsh ?
> 
> Yes, virsh is a client, as is virt-manager or any application connecting to
> libvirtd.
> 
>> Why do i have regular timeouts although my two hosts are very performant ? 
>> 128GB
>> RAM, 16 cores, 2 1GBit/s network adapter on each host in bonding.
>> During migration i don't see much load, although nearly no waiting for IO.
> 
> I'd think concurrently migrating 3 VMs on a 1G network might cause some
> congestion :-).
> 
>> Should i set admin_keepalive_interval to -1 ?
> 
> You should try 'keepalive_interval = -1'. You can also avoid sending keepalive
> messages from virsh with the '-k' option, e.g. 'virsh -k 0 migrate ...'.
> 
> If this doesn't help, are you in a position to test a newer libvirt, 
> preferably
> master or the recent 4.10.0 release?

Hi Jim,

Unfortunately not.

I have some more questions, maybe you can help me a bit.
I found 
http://epic-alfa.kavli.tudelft.nl/share/doc/libvirt-devel-0.10.2/migration.html 
, which is
quite interesting.
When i migrate with virsh, i use:
virsh --connect=qemu:///system migrate --verbose --live  domain 
qemu+ssh://ha-idg-1/system

When pacemaker migrates, it creates this sequence:
virsh --connect=qemu:///system --quiet migrate --live  domain 
qemu+ssh://ha-idg-1/system
which is quite the same.
Do i understand the webpage correctly, is this a "Native migration, client to 
two libvirtd servers" ?

Furthermore the document says:
"To force migration over an alternate network interface the optional hypervisor 
specific URI must be provided".

I have both hosts also connected directly to each other with a bonding device 
using round-robin, and an internal ip (192.168.100.xx).
When i want to use this device, which is maybe a bit faster and more secure 
(directly connected), how do i have to specify that ?
virsh --connect=qemu:///system --quiet migrate --live  domain 
qemu+ssh://ha-idg-1/system tcp://192.168.100.xx
Does it have to be the ip from the source or the destination ? Does the source 
then use automatically use
also its device with 192.168.100.xx ?

Thanks.

Bernd

 

Helmholtz Zentrum Muenchen
Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH)
Ingolstaedter Landstr. 1
85764 Neuherberg
www.helmholtz-muenchen.de
Aufsichtsratsvorsitzende: MinDirig.in Petra Steiner-Hoffmann
Stellv.Aufsichtsratsvorsitzender: MinDirig. Dr. Manfred Wolter
Geschaeftsfuehrer: Prof. Dr. med. Dr. h.c. Matthias Tschoep, Heinrich Bassler, 
Dr. rer. nat. Alfons Enhsen
Registergericht: Amtsgericht Muenchen HRB 6466
USt-IdNr: DE 129521671

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users


Re: [libvirt-users] certificate pinning

2018-12-10 Thread Anastasiya Ruzhanskaya
Ok, thank you. I will play around with it.

I also noticed, that libvirt does not use this SNI extension. Actually,this
not needed here, as we have only one location for server certificate, but
this requires some modifications in mitmproxy, as for example tls in web
browsers always include this SNI extensions.

Are there maybe other big differences in tls implementation in libvirt or
maybe some assumptions that are taken during tls handhake process?

пн, 10 дек. 2018 г. в 13:25, Daniel P. Berrangé :

> On Mon, Dec 10, 2018 at 01:22:32PM +0300, Anastasiya Ruzhanskaya wrote:
> > And how libvirt checks that it trusts the CA? Just simply inspects the
> > cacert.pem file? Or it has some information inside about by which CA were
> > signed client and server certificates and then compares against stored
> > values? I mean can I just concatenate after signing or I need to combine
> > two CAs before generating libvirt's client and server certificates?
>
> Libvirt will check that the server's certificate is signed by any one of
> the CAs listed.
>
> Regards,
> Daniel
> --
> |: https://berrange.com  -o-
> https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org -o-
> https://fstop138.berrange.com :|
> |: https://entangle-photo.org-o-
> https://www.instagram.com/dberrange :|
>
___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

Re: [libvirt-users] certificate pinning

2018-12-10 Thread Daniel P . Berrangé
On Mon, Dec 10, 2018 at 01:22:32PM +0300, Anastasiya Ruzhanskaya wrote:
> And how libvirt checks that it trusts the CA? Just simply inspects the
> cacert.pem file? Or it has some information inside about by which CA were
> signed client and server certificates and then compares against stored
> values? I mean can I just concatenate after signing or I need to combine
> two CAs before generating libvirt's client and server certificates?

Libvirt will check that the server's certificate is signed by any one of
the CAs listed.

Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users


Re: [libvirt-users] certificate pinning

2018-12-10 Thread Anastasiya Ruzhanskaya
And how libvirt checks that it trusts the CA? Just simply inspects the
cacert.pem file? Or it has some information inside about by which CA were
signed client and server certificates and then compares against stored
values? I mean can I just concatenate after signing or I need to combine
two CAs before generating libvirt's client and server certificates?

пн, 10 дек. 2018 г. в 13:11, Daniel P. Berrangé :

> Re-adding the libvirt-users list - please don't take discussions off-list.
>
> On Mon, Dec 10, 2018 at 01:10:18PM +0300, Anastasiya Ruzhanskaya wrote:
> > I already found out how to set up all the certificates and tls works fine
> > for me.
> > What if I want to put a proxy between client and server in libvirt? He
> has
> > his own CA, and this is only one more CA I would like libvirt to trust
> to.
> > Is it somehow achievable? I see that libvirt takes certificates only from
> > predefined paths. For me doesn't work if I just incert another CA
> > certificate to the cacert.pem file. Do you know any approaches how it can
> > be made in another way?
>
> The cacert.pem file can contain multiple certificates, just concatenate
> all the CA pem files.
>
> >
> > пн, 10 дек. 2018 г. в 12:38, Daniel P. Berrangé :
> >
> > > On Sat, Dec 08, 2018 at 11:19:40AM +0300, Anastasiya Ruzhanskaya wrote:
> > > > Hello!
> > > > Does libvirt uses certificate pinning in tls? I want to setup a
> > > transparent
> > > > proxy (mitmproxy) and can't do this even after I added mitmproxy ca
> > > > certificate to the trusted certificates in ubuntu.
> > >
> > > Libvirt doesn't ever use the global certificates stores, because public
> > > CAs are not relevant to libvirt deployments - indeed trusting the
> global
> > > cert store in the OS would lower security by opening it upto arbitrary
> > > CAs. See this doc for where libvirt finds CA certs
> > >
> > > https://libvirt.org/remote.html#Remote_certificates
> > >
> > >
> > > Regards,
> > > Daniel
> > > --
> > > |: https://berrange.com  -o-
> > > https://www.flickr.com/photos/dberrange :|
> > > |: https://libvirt.org -o-
> > > https://fstop138.berrange.com :|
> > > |: https://entangle-photo.org-o-
> > > https://www.instagram.com/dberrange :|
> > >
>
> Regards,
> Daniel
> --
> |: https://berrange.com  -o-
> https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org -o-
> https://fstop138.berrange.com :|
> |: https://entangle-photo.org-o-
> https://www.instagram.com/dberrange :|
>
___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

Re: [libvirt-users] certificate pinning

2018-12-10 Thread Daniel P . Berrangé
Re-adding the libvirt-users list - please don't take discussions off-list.

On Mon, Dec 10, 2018 at 01:10:18PM +0300, Anastasiya Ruzhanskaya wrote:
> I already found out how to set up all the certificates and tls works fine
> for me.
> What if I want to put a proxy between client and server in libvirt? He has
> his own CA, and this is only one more CA I would like libvirt to trust to.
> Is it somehow achievable? I see that libvirt takes certificates only from
> predefined paths. For me doesn't work if I just incert another CA
> certificate to the cacert.pem file. Do you know any approaches how it can
> be made in another way?

The cacert.pem file can contain multiple certificates, just concatenate
all the CA pem files.

> 
> пн, 10 дек. 2018 г. в 12:38, Daniel P. Berrangé :
> 
> > On Sat, Dec 08, 2018 at 11:19:40AM +0300, Anastasiya Ruzhanskaya wrote:
> > > Hello!
> > > Does libvirt uses certificate pinning in tls? I want to setup a
> > transparent
> > > proxy (mitmproxy) and can't do this even after I added mitmproxy ca
> > > certificate to the trusted certificates in ubuntu.
> >
> > Libvirt doesn't ever use the global certificates stores, because public
> > CAs are not relevant to libvirt deployments - indeed trusting the global
> > cert store in the OS would lower security by opening it upto arbitrary
> > CAs. See this doc for where libvirt finds CA certs
> >
> > https://libvirt.org/remote.html#Remote_certificates
> >
> >
> > Regards,
> > Daniel
> > --
> > |: https://berrange.com  -o-
> > https://www.flickr.com/photos/dberrange :|
> > |: https://libvirt.org -o-
> > https://fstop138.berrange.com :|
> > |: https://entangle-photo.org-o-
> > https://www.instagram.com/dberrange :|
> >

Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users

Re: [libvirt-users] certificate pinning

2018-12-10 Thread Daniel P . Berrangé
On Sat, Dec 08, 2018 at 11:19:40AM +0300, Anastasiya Ruzhanskaya wrote:
> Hello!
> Does libvirt uses certificate pinning in tls? I want to setup a transparent
> proxy (mitmproxy) and can't do this even after I added mitmproxy ca
> certificate to the trusted certificates in ubuntu.

Libvirt doesn't ever use the global certificates stores, because public
CAs are not relevant to libvirt deployments - indeed trusting the global
cert store in the OS would lower security by opening it upto arbitrary
CAs. See this doc for where libvirt finds CA certs

https://libvirt.org/remote.html#Remote_certificates


Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users