[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] qemu-nbd: Permit TLS with Unix sockets
From: |
Eric Blake |
Subject: |
Re: [Qemu-devel] [PATCH] qemu-nbd: Permit TLS with Unix sockets |
Date: |
Thu, 27 Jun 2019 10:37:52 -0500 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 |
On 6/27/19 9:58 AM, Daniel P. Berrangé wrote:
>>>
>>> Do you need something on the client side too ?
>>
>> The proposal that Rich is working on for standardized NBD URIs [1] says
>> that we need a patch to support nbds://host/export and
>> nbds+unix://export?socket=/path as ways to request an encrypted client
>> connection with default encryption parameters. For anything more
>> complex, we have to use --imageopts and request an encrypted connection
>> by parts - but the QAPI schema already permits us to pass in an
>> 'tls-creds' parameter for both TCP and Unix sockets, so no, I don't
>> think we need any client side changes at this point.
Okay, I just tested that pre-patch, qemu-nbd --list refuses to connect,
but post-patch it works:
$ ./qemu-nbd -r -k /tmp/nbdsock --object \
tls-creds-psk,id=tls0,endpoint=server,dir=/home/eblake/libnbd/tests \
--tls-creds tls0 -f raw -x / ./file
$ qemu-nbd --list -k /tmp/nbdsock --object \
tls-creds-psk,id=tls0,endpoint=client,dir=/home/eblake/libnbd/tests,username=eblake
\
--tls-creds tls0
qemu-nbd: TLS is only supported with IPv4/IPv6
$ ./qemu-nbd --list -k /tmp/nbdsock --object \
tls-creds-psk,id=tls0,endpoint=client,dir=/home/eblake/libnbd/tests,username=eblake
\
--tls-creds tls0
exports available: 1
...
>
> The QAPI schema isn't what I was thinking about.... in block/nbd.c
> we have the same restriction you lifted here
>
> tlscreds = nbd_get_tls_creds(s->tlscredsid, errp);
> if (!tlscreds) {
> goto error;
> }
>
> /* TODO SOCKET_ADDRESS_KIND_FD where fd has AF_INET or AF_INET6 */
> if (s->saddr->type != SOCKET_ADDRESS_TYPE_INET) {
> error_setg(errp, "TLS only supported over IP sockets");
> goto error;
> }
Oh. Yeah, I'll have to fix that; it's different than qemu-nbd --list.
>
> For client side we would also need to allow a 'tls-hostname' parameter
> in BlockdevOptionsNbd, so that the client can pass a hostname to use
> for validating the x509 certificate, the same way we allow for live
> migration.
Okay, v2 coming up later, once I've done more integration testing.
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3226
Virtualization: qemu.org | libvirt.org
signature.asc
Description: OpenPGP digital signature