On 03/10/2016 11:59 AM, Daniel P. Berrange wrote: > Currently any client which can complete the TLS handshake > is able to use a chardev server. The server admin can turn > on the 'verify-peer' option for the x509 creds to require > the client to provide a x509 certificate. This means the > client will have to acquire a certificate from the CA before > they are permitted to use the chardev server. This is still > a fairly weak bar. > > This adds a 'tls-acl=ACL-ID' option to the socket chardev > backend which takes the ID of a previously added 'QAuthZ' > object instance. This ACL will be used to validate the client's > x509 distinguished name. Clients failing the ACL will not be > permitted to use the chardev server. > > For example to setup an ACL that only allows connection from > a client whose x509 certificate distinguished name contains > 'CN=fred', you would use: > > $QEMU -object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\ > endpoint=server,verify-peer=yes \ > -object authz-simple,id=acl0,policy=deny,\ > rules.0.match=*CN=fred,rules.0.policy=allow \
Needs shell quoting for *, and also the same recurring comment about whitespace for presentation not actually being in the command line. Food for thought: should we enhance QemuOpts to skip all whitespace after ',', since we _know_ that valid key names start with a letter rather than a space? Then, we could represent command lines as: $QEMU -object 'name, param1=value, param2=value' with the same semantics as: $QEMU -object name,param1=value,param2=value and without having to worry about backslash-newline-whitespace formatting. Obviously, such an enhancement would be a separate patch. > -chardev socket,host=127.0.0.1,port=9000,server,\ > tls-creds=tls0,tls-acl=acl0 \ > ...other qemud args... > > Signed-off-by: Daniel P. Berrange <berra...@redhat.com> > --- > qapi-schema.json | 2 ++ > qemu-char.c | 11 ++++++++++- > 2 files changed, 12 insertions(+), 1 deletion(-) > Code is fine; my only comments were on the commit message. Reviewed-by: Eric Blake <ebl...@redhat.com> -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature