From 0ec2ae376b7d8ff05927a505ad0e13b0bb1efea7 Mon Sep 17 00:00:00 2001 From: Sebastian Eydam Date: Tue, 14 Apr 2026 13:56:18 +0200 Subject: [PATCH] vmm: accept migration connections over TLS Extend ReceiveListener with a TLS-backed listener variant for migration receivers. Store the TCP listener together with the server TLS configuration, wrap accepted sockets in TlsStream::new_server(), and preserver the existing listener cloning and fd polling behavior so receive-side migration code can treat TLS listeners like the existing TCP and UNIX cases. On-behalf-of: SAP sebastian.eydam@sap.com Signed-off-by: Sebastian Eydam --- vm-migration/src/tls.rs | 2 +- vmm/src/migration_transport.rs | 21 ++++++++++++++++++++- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/vm-migration/src/tls.rs b/vm-migration/src/tls.rs index 976fc466b..c0ecb7628 100644 --- a/vm-migration/src/tls.rs +++ b/vm-migration/src/tls.rs @@ -273,7 +273,7 @@ impl WriteVolatile for TlsStream { /// Carries a TLS server configuration. Intended to be turned into a [`TlsStream`] /// when paired with a [`TcpStream`]. -#[derive(Debug)] +#[derive(Debug, Clone)] pub struct TlsServerConfig { /// This config is shared between all server connections. config: Arc, diff --git a/vmm/src/migration_transport.rs b/vmm/src/migration_transport.rs index 4763d9949..a7df0c976 100644 --- a/vmm/src/migration_transport.rs +++ b/vmm/src/migration_transport.rs @@ -26,7 +26,7 @@ use vm_memory::{ VolatileSlice, WriteVolatile, }; use vm_migration::protocol::{Command, MemoryRangeTable, Request, Response}; -use vm_migration::tls::TlsStream; +use vm_migration::tls::{TlsServerConfig, TlsStream}; use vm_migration::{MigratableError, Snapshot}; use vmm_sys_util::eventfd::EventFd; @@ -42,6 +42,7 @@ pub(crate) const MAX_MIGRATION_CONNECTIONS: u32 = 128; pub(crate) enum ReceiveListener { Tcp(TcpListener), Unix(UnixListener), + Tls(TcpListener, TlsServerConfig), } impl ReceiveListener { @@ -58,6 +59,18 @@ impl ReceiveListener { .map(|(socket, _)| SocketStream::Unix(socket)) .context("Failed to accept Unix migration connection") .map_err(MigratableError::MigrateReceive), + ReceiveListener::Tls(listener, config) => { + let (socket, _) = listener + .accept() + .context("Failed to accept TCP connection") + .map_err(MigratableError::MigrateReceive)?; + + TlsStream::new_server(socket, config) + .map(Box::new) + .map(SocketStream::Tls) + .context("Failed to accept TLS migration connection") + .map_err(MigratableError::MigrateReceive) + } } } @@ -91,6 +104,11 @@ impl ReceiveListener { .map(ReceiveListener::Unix) .context("Failed to clone Unix listener") .map_err(MigratableError::MigrateReceive), + ReceiveListener::Tls(listener, config) => listener + .try_clone() + .map(|listener| ReceiveListener::Tls(listener, config.clone())) + .context("Failed to clone TLS listener") + .map_err(MigratableError::MigrateReceive), } } } @@ -100,6 +118,7 @@ impl AsFd for ReceiveListener { match self { ReceiveListener::Tcp(listener) => listener.as_fd(), ReceiveListener::Unix(listener) => listener.as_fd(), + ReceiveListener::Tls(listener, _) => listener.as_fd(), } } }