[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [PATCH] qemu-nbd: Permit TLS with Unix sockets
From: |
Eric Blake |
Subject: |
Re: [Qemu-block] [PATCH] qemu-nbd: Permit TLS with Unix sockets |
Date: |
Thu, 27 Jun 2019 09:49:13 -0500 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 |
On 6/26/19 3:22 AM, Daniel P. Berrangé wrote:
> On Tue, Jun 25, 2019 at 09:49:42PM -0500, Eric Blake wrote:
>> Although you generally won't use encryption with a Unix socket (after
>> all, everything is local, so why waste the CPU power), there are
>> situations in testsuites where Unix sockets are much nicer than TCP
>> sockets. Since nbdkit allows encryption over both types of sockets,
>> it makes sense for qemu-nbd to do likewise.
>>
>> Signed-off-by: Eric Blake <address@hidden>
>> ---
>> qemu-nbd.c | 4 ----
>> 1 file changed, 4 deletions(-)
>
> Reviewed-by: Daniel P. Berrangé <address@hidden>
>
>
> Do you need something on the client side too ?
The proposal that Rich is working on for standardized NBD URIs [1] says
that we need a patch to support nbds://host/export and
nbds+unix://export?socket=/path as ways to request an encrypted client
connection with default encryption parameters. For anything more
complex, we have to use --imageopts and request an encrypted connection
by parts - but the QAPI schema already permits us to pass in an
'tls-creds' parameter for both TCP and Unix sockets, so no, I don't
think we need any client side changes at this point.
I do, however, plan to test that 'qemu-nbd --list -k socket --tls...'
works (I think it does, and it can be used even without this patch
against nbdkit as server...), prior to taking this patch through my NBD
tree.
[1] https://lists.debian.org/nbd/2019/06/msg00011.html
>
>
> Regards,
> Daniel
>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3226
Virtualization: qemu.org | libvirt.org
signature.asc
Description: OpenPGP digital signature