On 6/26/19 3:22 AM, Daniel P. Berrangé wrote: > On Tue, Jun 25, 2019 at 09:49:42PM -0500, Eric Blake wrote: >> Although you generally won't use encryption with a Unix socket (after >> all, everything is local, so why waste the CPU power), there are >> situations in testsuites where Unix sockets are much nicer than TCP >> sockets. Since nbdkit allows encryption over both types of sockets, >> it makes sense for qemu-nbd to do likewise. >> >> Signed-off-by: Eric Blake <ebl...@redhat.com> >> --- >> qemu-nbd.c | 4 ---- >> 1 file changed, 4 deletions(-) > > Reviewed-by: Daniel P. Berrangé <berra...@redhat.com> > > > Do you need something on the client side too ?
The proposal that Rich is working on for standardized NBD URIs [1] says that we need a patch to support nbds://host/export and nbds+unix://export?socket=/path as ways to request an encrypted client connection with default encryption parameters. For anything more complex, we have to use --imageopts and request an encrypted connection by parts - but the QAPI schema already permits us to pass in an 'tls-creds' parameter for both TCP and Unix sockets, so no, I don't think we need any client side changes at this point. I do, however, plan to test that 'qemu-nbd --list -k socket --tls...' works (I think it does, and it can be used even without this patch against nbdkit as server...), prior to taking this patch through my NBD tree. [1] https://lists.debian.org/nbd/2019/06/msg00011.html > > > Regards, > Daniel > -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3226 Virtualization: qemu.org | libvirt.org
signature.asc
Description: OpenPGP digital signature
