On 03/10/2016 11:59 AM, Daniel P. Berrange wrote: > Currently any client which can complete the TLS handshake > is able to use the NBD server. The server admin can turn > on the 'verify-peer' option for the x509 creds to require > the client to provide a x509 certificate. This means the > client will have to acquire a certificate from the CA before > they are permitted to use the NBD server. This is still a > fairly weak bar. > > This adds a '--tls-acl ACL-ID' option to the qemu-nbd command > which takes the ID of a previously added 'QAuthZ' object > instance. This ACL will be used to validate the client's > x509 distinguished name. Clients failing the ACL will not be > permitted to use the NBD server. > > For example to setup an ACL that only allows connection from > a client whose x509 certificate distinguished name contains > 'CN=fred', you would use: > > qemu-nbd -object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\ > endpoint=server,verify-peer=yes \ > -object authz-simple,id=acl0,policy=deny,\ > rules.0.match=*CN=fred,rules.0.policy=allow \ > -tls-creds tls0 \ > -tls-acl acl0 > ....other qemu-nbd args...
Ah, so you are arguing that this is feature-completion of work started in 2.6, continuing work started before soft-freeze, and not a new feature to be delayed to 2.7. > > Signed-off-by: Daniel P. Berrange <berra...@redhat.com> > --- > qemu-nbd.c | 13 ++++++++++++- > qemu-nbd.texi | 4 ++++ > 2 files changed, 16 insertions(+), 1 deletion(-) > > +++ b/qemu-nbd.texi > @@ -86,6 +86,10 @@ the new style NBD protocol negotiation > Enable mandatory TLS encryption for the server by setting the ID > of the TLS credentials object previously created with the --object > option. > +@item --tls-acl=ID > +Specify the ID of a qauthz object previously created with the > +--object option. This will be used to authorize users who > +connect against their x509 distinguish name. s/distinguish/distinguished/ Reviewed-by: Eric Blake <ebl...@redhat.com> -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature