On Tue, Jul 03, 2018 at 09:03:03AM +0100, Richard W.M. Jones wrote: > Pre-Shared Keys (PSK) is a simpler mechanism for enabling TLS > connections than using certificates. It requires only a simple secret > key: > > $ mkdir -m 0700 /tmp/keys > $ psktool -u rjones -p /tmp/keys/keys.psk > $ cat /tmp/keys/keys.psk > rjones:d543770c15ad93d76443fb56f501a31969235f47e999720ae8d2336f6a13fcbc > > The key can be secretly shared between clients and servers. Clients > must specify the directory containing the "keys.psk" file and a > username (defaults to "qemu"). Servers must specify only the > directory. > > Example NBD client: > > $ qemu-img info \ > --object > tls-creds-psk,id=tls0,dir=/tmp/keys,username=rjones,endpoint=client \ > --image-opts \ > > file.driver=nbd,file.host=localhost,file.port=10809,file.tls-creds=tls0,file.export=/ > > Example NBD server using qemu-nbd: > > $ qemu-nbd -t -x / \ > --object tls-creds-psk,id=tls0,endpoint=server,dir=/tmp/keys \ > --tls-creds tls0 \ > image.qcow2 > > Example NBD server using nbdkit: > > $ nbdkit -n -e / -fv \ > --tls=on --tls-psk=/tmp/keys/keys.psk \ > file file=disk.img > > Signed-off-by: Richard W.M. Jones <rjo...@redhat.com> > --- > crypto/Makefile.objs | 1 + > crypto/tlscredspsk.c | 308 +++++++++++++++++++++++++++++++++ > crypto/tlssession.c | 56 +++++- > crypto/trace-events | 3 + > include/crypto/tlscredspsk.h | 106 ++++++++++++ > qemu-doc.texi | 37 ++++ > qemu-options.hx | 24 +++ > tests/Makefile.include | 4 +- > tests/crypto-tls-psk-helpers.c | 50 ++++++ > tests/crypto-tls-psk-helpers.h | 29 ++++ > tests/test-crypto-tlssession.c | 185 +++++++++++++++++--- > 11 files changed, 777 insertions(+), 26 deletions(-)
Signed-off-by: Daniel P. Berrangé <berra...@redhat.com> I'll send a pull request with it shortly Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|