[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [PATCH v5 2/2] nbd: allow authorization with nbd-server
From: |
Eric Blake |
Subject: |
Re: [Qemu-block] [PATCH v5 2/2] nbd: allow authorization with nbd-server-start QMP command |
Date: |
Wed, 27 Feb 2019 08:30:08 -0600 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.0 |
On 2/27/19 5:51 AM, Daniel P. Berrangé wrote:
> From: "Daniel P. Berrange" <address@hidden>
>
> As with the previous patch to qemu-nbd, the nbd-server-start QMP command
> also needs to be able to specify authorization when enabling TLS encryption.
>
> They can then reference this in the new 'tls-authz' parameter when
> executing the 'nbd-server-start' command:
>
> {
> 'execute': 'nbd-server-start',
> 'arguments': {
> 'addr': {
> 'type': 'inet',
> 'host': '127.0.0.1',
> 'port': '9000'
> },
> 'tls-creds': 'tls0',
> 'tls-authz': 'authz0'
> }
> }
>
> +++ b/qapi/block.json
> @@ -225,6 +225,11 @@
> #
> # @addr: Address on which to listen.
> # @tls-creds: (optional) ID of the TLS credentials object. Since 2.6
> +# @tls-authz: ID of the QAuthZ authorization object used to validate
> +# the client's x509 distinguished name. This object is
> +# is only resolved at time of use, so can be deleted and
> +# recreated on the fly while the NBD server is active.
> +# If missing, it will default to denying access. Since 4.0
Pre-existing formatting nit - per-variable release notes tend to be
wrapped in (), as in '(since 4.0)'. tls-creds would need fixing, if we
also want that for tls-authz. But we aren't 100% consistent, and it is
minor, so it does not stop me from:
Reviewed-by: Eric Blake <address@hidden>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3226
Virtualization: qemu.org | libvirt.org