Re: [Qemu-devel] [PATCH] doc: switch to modern syntx for VNC TLS setup

[Eric Blake]

On 06/28/2018 08:17 AM, Daniel P. Berrangé wrote:
> Ping, anyone have comments on this, besides the typo in $SUBJECT,
> also repeated in commit msg
>
> On Thu, Jun 07, 2018 at 11:10:19AM +0100, Daniel P. Berrangé wrote:
> > The use of 'tls', 'x509' and 'x509verify' properties is the legacy
> > backcompat syntx, replaced by use of TLS creds objects.
> >
> > Signed-off-by: Daniel P. Berrangé <address@hidden>
> > ---
> >   qemu-doc.texi | 20 +++++++++++++++-----
> >   1 file changed, 15 insertions(+), 5 deletions(-)
> >
> > diff --git a/qemu-doc.texi b/qemu-doc.texi
> > index f00706b999..d526870479 100644
> > --- a/qemu-doc.texi
> > +++ b/qemu-doc.texi
> > @@ -1097,7 +1097,9 @@ support provides a secure session, but no authentication. 
> > This allows any
> >   client to connect, and provides an encrypted session.
> >   
> >   @example
> > -qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509=/etc/pki/qemu -monitor stdio
> > +qemu-system-i386 [...OPTIONS...] \
> > +  -object 
> > tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=no \

I'd use --object here (especially since -object cannot be used on 
qemu-nbd, but --object tls-creds-x509 can).

> > +  -vnc :1,tls-creds=tls0 -monitor stdio
> >   @end example
> >   
> >   In the above example @code{/etc/pki/qemu} should contain at least three files,
> > @@ -1112,10 +1114,14 @@ only be readable by the user owning it.
> >   Certificates can also provide a means to authenticate the client connecting.
> >   The server will request that the client provide a certificate, which it will
> >   then validate against the CA certificate. This is a good choice if deploying
> > -in an environment with a private internal certificate authority.
> > +in an environment with a private internal certificate authority. It uses the
> > +same syntax as previously, but with @code{verify-peer} set to @code{yes}
> > +instead.
> >   
> >   @example
> > -qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509verify=/etc/pki/qemu -monitor 
> > stdio
> > +qemu-system-i386 [...OPTIONS...] \
> > +  -object 
> > tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \

multiple times in this patch.

Otherwise looks good to me.

--
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org