Merge ~noonedeadpunk/ubuntu/+source/libvirt:libvirt-sru-lp2133183-blokdev-tls-noble into ubuntu/+source/libvirt:ubuntu/noble-devel

[Dmitriy Rabotyagov]

Cherry-picked existing bugfix for live-migrations with TLS and local storage from https://github.com/libvirt/libvirt/commit/5d48c5d215071526383b8fc50d81ecde62e4111b in pkg/ubuntu/noble-devel

* debian/patches/ubuntu/lp-2133183-no-empty-string-tls-hostname.patch:
  Don't use empty string for 'tls-hostname' NBD blockdev.
  Thanks to Peter Krempa <email address hidden>. (LP: #2133183)

[Dmitriy Rabotyagov (noonedeadpunk)]

Hey folks!

Is there any way to get some attention to this PR and landing the backport to cover libvirt regression?

Unmerged commits

6d7d011... by Dmitriy Rabotyagov on 2025-11-27

* debian/patches/ubuntu/lp-2133183-no-empty-string-tls-hostname.patch:
  Don't use empty string for 'tls-hostname' NBD blockdev.
  Thanks to Peter Krempa <email address hidden>. (LP: #2133183)

diff --git a/debian/changelog b/debian/changelog
index e9441d9..6ee40c4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+libvirt (10.0.0-2ubuntu8.12) noble; urgency=medium
+
+  * debian/patches/ubuntu/lp-2133183-no-empty-string-tls-hostname.patch:
+    Don't use empty string for 'tls-hostname' NBD blockdev.
+    Thanks to Peter Krempa <[e-mail]>. (LP: #2133183)
+
+ -- Dmitriy Rabotyagov <[e-mail]>  Thu, 27 Nov 2025 21:48:00 +0100
+
 libvirt (10.0.0-2ubuntu8.11) noble-security; urgency=medium
 
   * SECURITY UPDATE: memory consumption DoS via XML parsing
diff --git a/debian/patches/series b/debian/patches/series
index e963811..eaa6f5d 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -40,6 +40,7 @@ ubuntu/lp-2095488-virsysinfo-fix-RISC-V-detection.patch
 ubuntu/lp2051239/1-qemu-capabilities-Add-QEMU_CAPS_VIRTIO_CCW_DEVICE.patch
 ubuntu/lp2051239/2-qemu-command-add-multi-boot-device-support-on-s39.patch
 ubuntu/lp-2117467-virdevmapper-device-name-for-targets.patch
+ubuntu/lp-2133183-no-empty-string-tls-hostname.patch
 
 # Ubuntu Apparmor Changes
 ubuntu-aa/0020-virt-aa-helper-ubuntu-storage-paths.patch
diff --git a/debian/patches/ubuntu/lp-2133183-no-empty-string-tls-hostname.patch b/debian/patches/ubuntu/lp-2133183-no-empty-string-tls-hostname.patch
new file mode 100644
index 0000000..3496729
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2133183-no-empty-string-tls-hostname.patch
@@ -0,0 +1,80 @@
+From 5d48c5d215071526383b8fc50d81ecde62e4111b Mon Sep 17 00:00:00 2001
+From: Peter Krempa <[e-mail]>
+Date: Fri, 19 Apr 2024 15:51:35 +0200
+Subject: [PATCH] qemu: migration: Don't use empty string for 'tls-hostname'
+ NBD blockdev
+
+While QEMU accepts and interprets an empty string in the tls-hostname
+field in migration parametes as if it's unset, the same does not apply
+for the 'tls-hostname' field when 'blockdev-add'-ing a NBD backend for
+non-shared storage migration.
+
+When libvirt sets up migation with TLS in 'qemuMigrationParamsEnableTLS'
+the QEMU_MIGRATION_PARAM_TLS_HOSTNAME migration parameter will be set to
+empty string in case when the 'hostname' argument is passed as NULL.
+
+Later on when setting up the NBD connections for non-shared storage
+migration 'qemuMigrationParamsGetTLSHostname', which fetches the value
+of the aforementioned TLS parameter.
+
+This bug was mostly latent until recently as libvirt used
+MIGRATION_DEST_CONNECT_HOST mode in most cases which required the
+hostname to be passed, thus the parameter was set properly.
+
+This changed with 8d693d79c40 for post-copy migration, where libvirt now
+instructs qemu to connect and thus passes NULL hostname to
+qemuMigrationParamsEnableTLS, which in turn causes libvirt to try to
+add NBD connection with empty string as tls-hostname resulting in:
+
+  error: internal error: unable to execute QEMU command 'blockdev-add': Certificate does not match the hostname
+
+To address this modify 'qemuMigrationParamsGetTLSHostname' to undo the
+weird semantics the migration code uses to handle TLS hostname and make
+it return NULL if the hostname is an empty string.
+
+Fixes: e8fa09d66bc
+Resolves: https://issues.redhat.com/browse/RHEL-32880
+Signed-off-by: Peter Krempa <[e-mail]>
+Reviewed-by: Jiri Denemark <[e-mail]>
+---
+ src/qemu/qemu_migration_params.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c
+index e955822f68f..48f8657f716 100644
+--- a/src/qemu/qemu_migration_params.c
++++ b/src/qemu/qemu_migration_params.c
+@@ -1158,6 +1158,7 @@ qemuMigrationParamsEnableTLS(virQEMUDriver *driver,
+                                      *tlsAlias) < 0)
+         return -1;
+ 
++    /* QEMU interprets an empty string for hostname as if it is not populated */
+     if (!migParams->params[QEMU_MIGRATION_PARAM_TLS_HOSTNAME].set &&
+         qemuMigrationParamsSetString(migParams,
+                                      QEMU_MIGRATION_PARAM_TLS_HOSTNAME,
+@@ -1659,13 +1660,23 @@ qemuMigrationCapsGet(virDomainObj *vm,
+  * @migParams: Migration params object
+  *
+  * Fetches the value of the QEMU_MIGRATION_PARAM_TLS_HOSTNAME parameter which is
+- * passed from the user as VIR_MIGRATE_PARAM_TLS_DESTINATION
++ * passed from the user as VIR_MIGRATE_PARAM_TLS_DESTINATION.
++ *
++ * In contrast with the migration parameter semantics, where an empty string
++ * is considered as if the hostname was not provided, this function will return
++ * NULL instead of an empty string as other parts of QEMU expect that the
++ * hostname is not provided at all.
+  */
+ const char *
+ qemuMigrationParamsGetTLSHostname(qemuMigrationParams *migParams)
+ {
++    const char *hostname = migParams->params[QEMU_MIGRATION_PARAM_TLS_HOSTNAME].value.s;
++
+     if (!migParams->params[QEMU_MIGRATION_PARAM_TLS_HOSTNAME].set)
+         return NULL;
+ 
+-    return migParams->params[QEMU_MIGRATION_PARAM_TLS_HOSTNAME].value.s;
++    if (STREQ(hostname, ""))
++        return NULL;
++
++    return hostname;
+ }