* Daniel P. Berrangé (berra...@redhat.com) wrote: > On Wed, Jun 20, 2018 at 03:22:53PM +0100, Dr. David Alan Gilbert wrote: > > * Daniel P. Berrangé (berra...@redhat.com) wrote: > > > From: "Daniel P. Berrange" <berra...@redhat.com> > > > > > > Currently any client which can complete the TLS handshake is able to use > > > the NBD server. The server admin can turn on the 'verify-peer' option > > > for the x509 creds to require the client to provide a x509 certificate. > > > This means the client will have to acquire a certificate from the CA > > > before they are permitted to use the NBD server. This is still a fairly > > > low bar to cross. > > > > > > This adds a '--tls-authz OBJECT-ID' option to the qemu-nbd command which > > > takes the ID of a previously added 'QAuthZ' object instance. This will > > > be used to validate the client's x509 distinguished name. Clients > > > failing the authorization check will not be permitted to use the NBD > > > server. > > > > > > For example to setup authorization that only allows connection from a > > > client > > > whose x509 certificate distinguished name is > > > > > > CN=laptop.example.com,O=Example Org,L=London,ST=London,C=GB > > > > > > use: > > > > > > qemu-nbd --object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\ > > > endpoint=server,verify-peer=yes \ > > > --object > > > authz-simple,id=auth0,identity=CN=laptop.example.com,,\ > > > O=Example Org,,L=London,,ST=London,,C=GB \ > > > > I'm confused about how that gets parsed, what differentiates the ,s > > that separate the arguments (e.g. ,id= ,identity=) and the ,s that > > separate the options within the identity string (e.g. the ,ST=London) > > That's why I've doubled up - eg ',,' must be used when you need to > include a literal ',' in a value without it being interpreted as > starting a new option
OK, yeh I forgot about the obscure double-comma rule. > > Would: > > --object authz-simple,identity=CN=laptop.example.com,,O=Example > > Org,,L=London,,ST=London,,C=GB,id=auth0 > > > > be equivalent? > > Yes OK. Dave > > > Regards, > Daniel > -- > |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| > |: https://libvirt.org -o- https://fstop138.berrange.com :| > |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| -- Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK