diff options
| author | Antoine Damhet <adamhet@scaleway.com> | 2026-02-27 13:45:53 +0100 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2026-03-10 15:48:48 +0100 |
| commit | 7b13fc97d7235006d2ccc7a132ecb70802ba258f (patch) | |
| tree | a27e5c01a7f32d1bf5efcf889f9eea863838f16f /qapi | |
| parent | 15c719a142c63809a6943625de156c3758af353d (diff) | |
| download | qemu-7b13fc97d7235006d2ccc7a132ecb70802ba258f.tar.gz qemu-7b13fc97d7235006d2ccc7a132ecb70802ba258f.zip | |
block/curl: add support for S3 presigned URLs
S3 presigned URLs are signed for a specific HTTP method (typically GET
for our use cases). The curl block driver currently issues a HEAD
request to discover the web server features and the file size, which
fails with 'HTTP 403' (forbidden).
Add a 'force-range' option that skips the HEAD request and instead
issues a minimal GET request (querying 1 byte from the server) to
extract the file size from the 'Content-Range' response header. To
achieve this the 'curl_header_cb' is redesigned to generically parse
HTTP headers.
$ $QEMU -drive driver=https,\
'url=https://s3.example.com/some.img?X-Amz-Security-Token=XXX',
force-range=true
Enabling the 'force-range' option without the web server specified with
@url supporting it might cause the server to respond successfully with
'HTTP 200' and attempt to send the whole file body. With the
'CURLOPT_NOBODY' option set the libcurl will skip reading after the
headers and close the connection. QEMU still gracefully detects the
missing feature. This might waste a small number of TCP packets but is
otherwise transparent to the user.
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Antoine Damhet <adamhet@scaleway.com>
Message-ID: <20260227-fix-curl-v3-v3-3-eb8a4d88feef@scaleway.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'qapi')
| -rw-r--r-- | qapi/block-core.json | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/qapi/block-core.json b/qapi/block-core.json index 8ba1fdc49d..f8d446b3d6 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -4587,12 +4587,18 @@ # @cookie-secret: ID of a QCryptoSecret object providing the cookie # data in a secure way. See @cookie for the format. (since 2.10) # +# @force-range: Don't issue a HEAD HTTP request to discover if the +# http server supports range requests and rely only on GET +# requests. This is especially useful for S3 presigned URLs where +# HEAD requests are unauthorized. (default: false; since 11.0) +# # Since: 2.9 ## { 'struct': 'BlockdevOptionsCurlHttp', 'base': 'BlockdevOptionsCurlBase', 'data': { '*cookie': 'str', - '*cookie-secret': 'str'} } + '*cookie-secret': 'str', + '*force-range': 'bool'} } ## # @BlockdevOptionsCurlHttps: |