From 1b5c15cebd5cc7595337a8a7cf14f6a707605e99 Mon Sep 17 00:00:00 2001 From: Eric Blake Date: Sat, 7 Sep 2019 12:20:55 -0500 Subject: nbd/client: Add hint when TLS is missing I received an off-list report of failure to connect to an NBD server expecting an x509 certificate, when the client was attempting something similar to this command line: $ ./x86_64-softmmu/qemu-system-x86_64 -name 'blah' -machine q35 -nodefaults \ -object tls-creds-x509,id=tls0,endpoint=client,dir=$path_to_certs \ -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie.0,addr=0x6 \ -drive id=drive_image1,if=none,snapshot=off,aio=threads,cache=none,format=raw,file=nbd:localhost:9000,werror=stop,rerror=stop,tls-creds=tls0 \ -device scsi-hd,id=image1,drive=drive_image1,bootindex=0 qemu-system-x86_64: -drive id=drive_image1,if=none,snapshot=off,aio=threads,cache=none,format=raw,file=nbd:localhost:9000,werror=stop,rerror=stop,tls-creds=tls0: TLS negotiation required before option 7 (go) server reported: Option 0x7 not permitted before TLS The problem? As specified, -drive is trying to pass tls-creds to the raw format driver instead of the nbd protocol driver, but before we get to the point where we can detect that raw doesn't know what to do with tls-creds, the nbd driver has already failed because the server complained. The fix to the broken command line? Pass '...,file.tls-creds=tls0' to ensure the tls-creds option is handed to nbd, not raw. But since the error message was rather cryptic, I'm trying to improve the error message. With this patch, the error message adds a line: qemu-system-x86_64: -drive id=drive_image1,if=none,snapshot=off,aio=threads,cache=none,format=raw,file=nbd:localhost:9000,werror=stop,rerror=stop,tls-creds=tls0: TLS negotiation required before option 7 (go) Did you forget a valid tls-creds? server reported: Option 0x7 not permitted before TLS And with luck, someone grepping for that error message will find this commit message and figure out their command line mistake. Sadly, the only mention of file.tls-creds in our docs relates to an --image-opts use of PSK encryption with qemu-img as the client, rather than x509 certificate encryption with qemu-kvm as the client. CC: Tingting Mao CC: Daniel P. Berrangé Signed-off-by: Eric Blake Message-Id: <20190907172055.26870-1-eblake@redhat.com> [eblake: squash in iotest 233 fix] Reviewed-by: Daniel P. Berrangé --- tests/qemu-iotests/233.out | 2 ++ 1 file changed, 2 insertions(+) (limited to 'tests') diff --git a/tests/qemu-iotests/233.out b/tests/qemu-iotests/233.out index 24321efa11..c3c344811b 100644 --- a/tests/qemu-iotests/233.out +++ b/tests/qemu-iotests/233.out @@ -21,8 +21,10 @@ server reported: TLS not configured == check plain client to TLS server fails == qemu-img: Could not open 'nbd://localhost:PORT': TLS negotiation required before option 7 (go) +Did you forget a valid tls-creds? server reported: Option 0x7 not permitted before TLS qemu-nbd: TLS negotiation required before option 3 (list) +Did you forget a valid tls-creds? server reported: Option 0x3 not permitted before TLS == check TLS works == -- cgit v1.2.3-55-g7522 From 506902c6fa80210b002e30ff33794bfc718b15c6 Mon Sep 17 00:00:00 2001 From: Eric Blake Date: Fri, 20 Sep 2019 17:07:29 -0500 Subject: tests: Use iothreads during iotest 223 Doing so catches the bugs we just fixed with NBD not properly using correct contexts. Signed-off-by: Eric Blake Message-Id: <20190920220729.31801-1-eblake@redhat.com> --- tests/qemu-iotests/223 | 6 ++++-- tests/qemu-iotests/223.out | 1 + 2 files changed, 5 insertions(+), 2 deletions(-) (limited to 'tests') diff --git a/tests/qemu-iotests/223 b/tests/qemu-iotests/223 index cc48e78ea7..2ba3d8124b 100755 --- a/tests/qemu-iotests/223 +++ b/tests/qemu-iotests/223 @@ -2,7 +2,7 @@ # # Test reading dirty bitmap over NBD # -# Copyright (C) 2018 Red Hat, Inc. +# Copyright (C) 2018-2019 Red Hat, Inc. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -109,7 +109,7 @@ echo echo "=== End dirty bitmaps, and start serving image over NBD ===" echo -_launch_qemu 2> >(_filter_nbd) +_launch_qemu -object iothread,id=io0 2> >(_filter_nbd) # Intentionally provoke some errors as well, to check error handling silent= @@ -117,6 +117,8 @@ _send_qemu_cmd $QEMU_HANDLE '{"execute":"qmp_capabilities"}' "return" _send_qemu_cmd $QEMU_HANDLE '{"execute":"blockdev-add", "arguments":{"driver":"qcow2", "node-name":"n", "file":{"driver":"file", "filename":"'"$TEST_IMG"'"}}}' "return" +_send_qemu_cmd $QEMU_HANDLE '{"execute":"x-blockdev-set-iothread", + "arguments":{"node-name":"n", "iothread":"io0"}}' "return" _send_qemu_cmd $QEMU_HANDLE '{"execute":"block-dirty-bitmap-disable", "arguments":{"node":"n", "name":"b"}}' "return" _send_qemu_cmd $QEMU_HANDLE '{"execute":"nbd-server-add", diff --git a/tests/qemu-iotests/223.out b/tests/qemu-iotests/223.out index 5d00398c11..23b34fcd20 100644 --- a/tests/qemu-iotests/223.out +++ b/tests/qemu-iotests/223.out @@ -27,6 +27,7 @@ wrote 2097152/2097152 bytes at offset 2097152 {"return": {}} {"return": {}} {"return": {}} +{"return": {}} {"error": {"class": "GenericError", "desc": "NBD server not running"}} {"return": {}} {"error": {"class": "GenericError", "desc": "NBD server already running"}} -- cgit v1.2.3-55-g7522