On 6/27/19 9:58 AM, Daniel P. Berrangé wrote: >>> >>> Do you need something on the client side too ? >> >> The proposal that Rich is working on for standardized NBD URIs [1] says >> that we need a patch to support nbds://host/export and >> nbds+unix://export?socket=/path as ways to request an encrypted client >> connection with default encryption parameters. For anything more >> complex, we have to use --imageopts and request an encrypted connection >> by parts - but the QAPI schema already permits us to pass in an >> 'tls-creds' parameter for both TCP and Unix sockets, so no, I don't >> think we need any client side changes at this point.
Okay, I just tested that pre-patch, qemu-nbd --list refuses to connect,
but post-patch it works:
$ ./qemu-nbd -r -k /tmp/nbdsock --object \
tls-creds-psk,id=tls0,endpoint=server,dir=/home/eblake/libnbd/tests \
--tls-creds tls0 -f raw -x / ./file
$ qemu-nbd --list -k /tmp/nbdsock --object \
tls-creds-psk,id=tls0,endpoint=client,dir=/home/eblake/libnbd/tests,username=eblake
\
--tls-creds tls0
qemu-nbd: TLS is only supported with IPv4/IPv6
$ ./qemu-nbd --list -k /tmp/nbdsock --object \
tls-creds-psk,id=tls0,endpoint=client,dir=/home/eblake/libnbd/tests,username=eblake
\
--tls-creds tls0
exports available: 1
...
>
> The QAPI schema isn't what I was thinking about.... in block/nbd.c
> we have the same restriction you lifted here
>
> tlscreds = nbd_get_tls_creds(s->tlscredsid, errp);
> if (!tlscreds) {
> goto error;
> }
>
> /* TODO SOCKET_ADDRESS_KIND_FD where fd has AF_INET or AF_INET6 */
> if (s->saddr->type != SOCKET_ADDRESS_TYPE_INET) {
> error_setg(errp, "TLS only supported over IP sockets");
> goto error;
> }
Oh. Yeah, I'll have to fix that; it's different than qemu-nbd --list.
>
> For client side we would also need to allow a 'tls-hostname' parameter
> in BlockdevOptionsNbd, so that the client can pass a hostname to use
> for validating the x509 certificate, the same way we allow for live
> migration.
Okay, v2 coming up later, once I've done more integration testing.
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3226
Virtualization: qemu.org | libvirt.org
signature.asc
Description: OpenPGP digital signature
