Re: [Qemu-devel] [PATCH] qemu-nbd: Permit TLS with Unix sockets

[Eric Blake <eblake@redhat.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2336 bytes --]

On 6/27/19 9:58 AM, Daniel P. Berrangé wrote:

>>>
>>> Do you need something on the client side too ?
>>
>> The proposal that Rich is working on for standardized NBD URIs [1] says
>> that we need a patch to support nbds://host/export and
>> nbds+unix://export?socket=/path as ways to request an encrypted client
>> connection with default encryption parameters. For anything more
>> complex, we have to use --imageopts and request an encrypted connection
>> by parts - but the QAPI schema already permits us to pass in an
>> 'tls-creds' parameter for both TCP and Unix sockets, so no, I don't
>> think we need any client side changes at this point.

Okay, I just tested that pre-patch, qemu-nbd --list refuses to connect,
but post-patch it works:

$ ./qemu-nbd -r -k /tmp/nbdsock --object \
  tls-creds-psk,id=tls0,endpoint=server,dir=/home/eblake/libnbd/tests \
  --tls-creds tls0 -f raw -x / ./file
$ qemu-nbd --list -k /tmp/nbdsock --object \

tls-creds-psk,id=tls0,endpoint=client,dir=/home/eblake/libnbd/tests,username=eblake
\
  --tls-creds tls0
qemu-nbd: TLS is only supported with IPv4/IPv6
$ ./qemu-nbd --list -k /tmp/nbdsock --object \

tls-creds-psk,id=tls0,endpoint=client,dir=/home/eblake/libnbd/tests,username=eblake
\
  --tls-creds tls0
exports available: 1
...

> 
> The QAPI schema isn't what I was thinking about....  in block/nbd.c
> we have the same restriction you lifted here
> 
>         tlscreds = nbd_get_tls_creds(s->tlscredsid, errp);
>         if (!tlscreds) {
>             goto error;
>         }
> 
>         /* TODO SOCKET_ADDRESS_KIND_FD where fd has AF_INET or AF_INET6 */
>         if (s->saddr->type != SOCKET_ADDRESS_TYPE_INET) {
>             error_setg(errp, "TLS only supported over IP sockets");
>             goto error;
>         }

Oh. Yeah, I'll have to fix that; it's different than qemu-nbd --list.

> 
> For client side we would also need to allow a 'tls-hostname' parameter
> in BlockdevOptionsNbd, so that the client can pass a hostname to use
> for validating the x509 certificate, the same way we allow for live
> migration.

Okay, v2 coming up later, once I've done more integration testing.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]