kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: accept migration connections over TLS

Browse Source 
Extend ReceiveListener with a TLS-backed listener variant for migration
receivers.

Store the TCP listener together with the server TLS configuration, wrap
accepted sockets in TlsStream::new_server(), and preserver the existing
listener cloning and fd polling behavior so receive-side migration code
can treat TLS listeners like the existing TCP and UNIX cases.

On-behalf-of: SAP sebastian.eydam@sap.com
Signed-off-by: Sebastian Eydam <sebastian.eydam@cyberus-technology.de>
This commit is contained in:
Sebastian Eydam
2026-04-14 13:56:18 +02:00
committed by Rob Bradford
parent f3623e6403
commit 0ec2ae376b
2 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
vmm/src/migration_transport.rs
View File

@@ -26,7 +26,7 @@ use vm_memory::{
VolatileSlice, WriteVolatile,
};
use vm_migration::protocol::{Command, MemoryRangeTable, Request, Response};
use vm_migration::tls::TlsStream;
use vm_migration::tls::{TlsServerConfig, TlsStream};
use vm_migration::{MigratableError, Snapshot};
use vmm_sys_util::eventfd::EventFd;
@@ -42,6 +42,7 @@ pub(crate) const MAX_MIGRATION_CONNECTIONS: u32 = 128;
pub(crate) enum ReceiveListener {
Tcp(TcpListener),
Unix(UnixListener),
Tls(TcpListener, TlsServerConfig),
}
impl ReceiveListener {
@@ -58,6 +59,18 @@ impl ReceiveListener {
.map(|(socket, _)| SocketStream::Unix(socket))
.context("Failed to accept Unix migration connection")
.map_err(MigratableError::MigrateReceive),
ReceiveListener::Tls(listener, config) => {
let (socket, _) = listener
.accept()
.context("Failed to accept TCP connection")
.map_err(MigratableError::MigrateReceive)?;
TlsStream::new_server(socket, config)
.map(Box::new)
.map(SocketStream::Tls)
.context("Failed to accept TLS migration connection")
.map_err(MigratableError::MigrateReceive)
}
}
}
@@ -91,6 +104,11 @@ impl ReceiveListener {
.map(ReceiveListener::Unix)
.context("Failed to clone Unix listener")
.map_err(MigratableError::MigrateReceive),
ReceiveListener::Tls(listener, config) => listener
.try_clone()
.map(|listener| ReceiveListener::Tls(listener, config.clone()))
.context("Failed to clone TLS listener")
.map_err(MigratableError::MigrateReceive),
}
}
}
@@ -100,6 +118,7 @@ impl AsFd for ReceiveListener {
match self {
ReceiveListener::Tcp(listener) => listener.as_fd(),
ReceiveListener::Unix(listener) => listener.as_fd(),
ReceiveListener::Tls(listener, _) => listener.as_fd(),
}
}
}