|
 |
fbe740 |
From 270be96a2730304de8f5dd1d24dd367c9ed52b22 Mon Sep 17 00:00:00 2001
|
|
|
fbe740 |
Message-Id: <270be96a2730304de8f5dd1d24dd367c9ed52b22@dist-git>
|
|
|
fbe740 |
From: Peter Krempa <pkrempa@redhat.com>
|
|
|
fbe740 |
Date: Mon, 16 Mar 2020 22:12:02 +0100
|
|
|
fbe740 |
Subject: [PATCH] qemu: domain: Store data for 'secret' object representing
|
|
|
fbe740 |
http cookies
|
|
|
fbe740 |
MIME-Version: 1.0
|
|
|
fbe740 |
Content-Type: text/plain; charset=UTF-8
|
|
|
fbe740 |
Content-Transfer-Encoding: 8bit
|
|
|
fbe740 |
|
|
|
fbe740 |
The http cookies can have potentially sensitive values and thus should
|
|
|
fbe740 |
not be leaked into the command line. This means that we'll need to
|
|
|
fbe740 |
instantiate a 'secret' object in qemu to pass the value encrypted.
|
|
|
fbe740 |
|
|
|
fbe740 |
This patch adds infrastructure for storing of the alias in the status
|
|
|
fbe740 |
XML.
|
|
|
fbe740 |
|
|
|
fbe740 |
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
|
|
|
fbe740 |
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
|
fbe740 |
(cherry picked from commit 4e8faa5cdc54ce637f760ad4513753e17d2b9a4f)
|
|
|
fbe740 |
|
|
|
fbe740 |
Conflicts:
|
|
|
fbe740 |
src/qemu/qemu_domain.c:
|
|
|
fbe740 |
Context conflict with missing backport of cleanups. (mentioned
|
|
|
fbe740 |
earlier)
|
|
|
fbe740 |
|
|
|
fbe740 |
https://bugzilla.redhat.com/show_bug.cgi?id=1804750
|
|
|
fbe740 |
Message-Id: <b51659e22b0840ca6c5431c4e212445bdeb4c12d.1584391727.git.pkrempa@redhat.com>
|
|
|
fbe740 |
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
|
fbe740 |
---
|
|
|
fbe740 |
src/qemu/qemu_domain.c | 8 +++++++-
|
|
|
fbe740 |
src/qemu/qemu_domain.h | 3 +++
|
|
|
fbe740 |
tests/qemustatusxml2xmldata/modern-in.xml | 1 +
|
|
|
fbe740 |
3 files changed, 11 insertions(+), 1 deletion(-)
|
|
|
fbe740 |
|
|
|
fbe740 |
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
|
|
|
fbe740 |
index 2920e699f6..9391bc37e0 100644
|
|
|
fbe740 |
--- a/src/qemu/qemu_domain.c
|
|
|
fbe740 |
+++ b/src/qemu/qemu_domain.c
|
|
|
fbe740 |
@@ -2341,6 +2341,7 @@ qemuStorageSourcePrivateDataParse(xmlXPathContextPtr ctxt,
|
|
|
fbe740 |
char *authalias = NULL;
|
|
|
fbe740 |
char *encalias = NULL;
|
|
|
fbe740 |
int ret = -1;
|
|
|
fbe740 |
+ g_autofree char *httpcookiealias = NULL;
|
|
|
fbe740 |
|
|
|
fbe740 |
src->nodestorage = virXPathString("string(./nodenames/nodename[@type='storage']/@name)", ctxt);
|
|
|
fbe740 |
src->nodeformat = virXPathString("string(./nodenames/nodename[@type='format']/@name)", ctxt);
|
|
|
fbe740 |
@@ -2354,8 +2355,9 @@ qemuStorageSourcePrivateDataParse(xmlXPathContextPtr ctxt,
|
|
|
fbe740 |
|
|
|
fbe740 |
authalias = virXPathString("string(./objects/secret[@type='auth']/@alias)", ctxt);
|
|
|
fbe740 |
encalias = virXPathString("string(./objects/secret[@type='encryption']/@alias)", ctxt);
|
|
|
fbe740 |
+ httpcookiealias = virXPathString("string(./objects/secret[@type='httpcookie']/@alias)", ctxt);
|
|
|
fbe740 |
|
|
|
fbe740 |
- if (authalias || encalias) {
|
|
|
fbe740 |
+ if (authalias || encalias || httpcookiealias) {
|
|
|
fbe740 |
if (!src->privateData &&
|
|
|
fbe740 |
!(src->privateData = qemuDomainStorageSourcePrivateNew()))
|
|
|
fbe740 |
goto cleanup;
|
|
|
fbe740 |
@@ -2367,6 +2369,9 @@ qemuStorageSourcePrivateDataParse(xmlXPathContextPtr ctxt,
|
|
|
fbe740 |
|
|
|
fbe740 |
if (qemuStorageSourcePrivateDataAssignSecinfo(&priv->encinfo, &encalias) < 0)
|
|
|
fbe740 |
goto cleanup;
|
|
|
fbe740 |
+
|
|
|
fbe740 |
+ if (qemuStorageSourcePrivateDataAssignSecinfo(&priv->httpcookie, &httpcookiealias) < 0)
|
|
|
fbe740 |
+ goto cleanup;
|
|
|
fbe740 |
}
|
|
|
fbe740 |
|
|
|
fbe740 |
if (virStorageSourcePrivateDataParseRelPath(ctxt, src) < 0)
|
|
|
fbe740 |
@@ -2423,6 +2428,7 @@ qemuStorageSourcePrivateDataFormat(virStorageSourcePtr src,
|
|
|
fbe740 |
if (srcPriv) {
|
|
|
fbe740 |
qemuStorageSourcePrivateDataFormatSecinfo(&tmp, srcPriv->secinfo, "auth");
|
|
|
fbe740 |
qemuStorageSourcePrivateDataFormatSecinfo(&tmp, srcPriv->encinfo, "encryption");
|
|
|
fbe740 |
+ qemuStorageSourcePrivateDataFormatSecinfo(&tmp, srcPriv->httpcookie, "httpcookie");
|
|
|
fbe740 |
}
|
|
|
fbe740 |
|
|
|
fbe740 |
if (src->tlsAlias)
|
|
|
fbe740 |
diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
|
|
|
fbe740 |
index bd9ac85ae2..5733954679 100644
|
|
|
fbe740 |
--- a/src/qemu/qemu_domain.h
|
|
|
fbe740 |
+++ b/src/qemu/qemu_domain.h
|
|
|
fbe740 |
@@ -460,6 +460,9 @@ struct _qemuDomainStorageSourcePrivate {
|
|
|
fbe740 |
|
|
|
fbe740 |
/* data required for decryption of encrypted storage source */
|
|
|
fbe740 |
qemuDomainSecretInfoPtr encinfo;
|
|
|
fbe740 |
+
|
|
|
fbe740 |
+ /* secure passthrough of the http cookie */
|
|
|
fbe740 |
+ qemuDomainSecretInfoPtr httpcookie;
|
|
|
fbe740 |
};
|
|
|
fbe740 |
|
|
|
fbe740 |
virObjectPtr qemuDomainStorageSourcePrivateNew(void);
|
|
|
fbe740 |
diff --git a/tests/qemustatusxml2xmldata/modern-in.xml b/tests/qemustatusxml2xmldata/modern-in.xml
|
|
|
fbe740 |
index c8d21ceada..cb56cdcef9 100644
|
|
|
fbe740 |
--- a/tests/qemustatusxml2xmldata/modern-in.xml
|
|
|
fbe740 |
+++ b/tests/qemustatusxml2xmldata/modern-in.xml
|
|
|
fbe740 |
@@ -332,6 +332,7 @@
|
|
|
fbe740 |
<objects>
|
|
|
fbe740 |
<secret type='auth' alias='test-auth-alias'/>
|
|
|
fbe740 |
<secret type='encryption' alias='test-encryption-alias'/>
|
|
|
fbe740 |
+ <secret type='httpcookie' alias='http-cookie-alias'/>
|
|
|
fbe740 |
<TLSx509 alias='transport-alias'/>
|
|
|
fbe740 |
</objects>
|
|
|
fbe740 |
</privateData>
|
|
|
fbe740 |
--
|
|
|
fbe740 |
2.25.1
|
|
|
fbe740 |
|