Re: about QEMU TLS

["Daniel P. Berrangé" <berrange@redhat.com>]

On Mon, Aug 07, 2023 at 12:07:31AM +0200, Yu Zhang wrote:
> Hi all,
> 
> According to qemu docs [1], TLS parameters are specified as an object in
> the QEMU command line:
> 
>    -object tls-creds-x509,id=id,endpoint=endpoint,dir=/path/to/cred/dir ...
> 
> of which "endpoint" is a type of "QCryptoTLSCredsEndpoint" and can be
> either a "server" or a "client".
> 
> I'd like to know:
> 
> - When a VM is started with this config, is there a way (e.g. QMP) to
> change the value of "endpoint"?
>   If possible, how to do this? or else after the first migration of a VM,
> the VM has "endpoint=server",
>   which can't be migrated without stop / start.

Use object_del + object_add to delete the old credentials and
create new ones.

> - In which case does the QEMU reload its TLS certificate, e.g. when a QEMU
> VM has been run longer
>   than the valid period of its TLS certificate?

The certs are loaded at the time the incoming/outgoing migration
operation is initiated, so they are always fresh.

> - The migration is done by using HMP monitor on both source and target
> side. Is it possible to do it
>   by using QMP commands?

Almost everything in HMP has an equivalent QMP command.


With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|