[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v3 07/10] qemu-nbd: add support for ACLs for TLS
From: |
Eric Blake |
Subject: |
Re: [Qemu-devel] [PATCH v3 07/10] qemu-nbd: add support for ACLs for TLS clients |
Date: |
Tue, 22 Mar 2016 12:14:27 -0600 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 |
On 03/10/2016 11:59 AM, Daniel P. Berrange wrote:
> Currently any client which can complete the TLS handshake
> is able to use the NBD server. The server admin can turn
> on the 'verify-peer' option for the x509 creds to require
> the client to provide a x509 certificate. This means the
> client will have to acquire a certificate from the CA before
> they are permitted to use the NBD server. This is still a
> fairly weak bar.
>
> This adds a '--tls-acl ACL-ID' option to the qemu-nbd command
> which takes the ID of a previously added 'QAuthZ' object
> instance. This ACL will be used to validate the client's
> x509 distinguished name. Clients failing the ACL will not be
> permitted to use the NBD server.
>
> For example to setup an ACL that only allows connection from
> a client whose x509 certificate distinguished name contains
> 'CN=fred', you would use:
>
> qemu-nbd -object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
> endpoint=server,verify-peer=yes \
> -object authz-simple,id=acl0,policy=deny,\
> rules.0.match=*CN=fred,rules.0.policy=allow \
> -tls-creds tls0 \
> -tls-acl acl0
> ....other qemu-nbd args...
Ah, so you are arguing that this is feature-completion of work started
in 2.6, continuing work started before soft-freeze, and not a new
feature to be delayed to 2.7.
>
> Signed-off-by: Daniel P. Berrange <address@hidden>
> ---
> qemu-nbd.c | 13 ++++++++++++-
> qemu-nbd.texi | 4 ++++
> 2 files changed, 16 insertions(+), 1 deletion(-)
>
> +++ b/qemu-nbd.texi
> @@ -86,6 +86,10 @@ the new style NBD protocol negotiation
> Enable mandatory TLS encryption for the server by setting the ID
> of the TLS credentials object previously created with the --object
> option.
> address@hidden --tls-acl=ID
> +Specify the ID of a qauthz object previously created with the
> +--object option. This will be used to authorize users who
> +connect against their x509 distinguish name.
s/distinguish/distinguished/
Reviewed-by: Eric Blake <address@hidden>
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature
- [Qemu-devel] [PATCH v3 02/10] qapi: allow QmpInputVisitor to auto-cast types, (continued)
[Qemu-devel] [PATCH v3 03/10] qom: support arbitrary non-scalar properties with -object, Daniel P. Berrange, 2016/03/10
Re: [Qemu-devel] [PATCH v3 03/10] qom: support arbitrary non-scalar properties with -object, Daniel P. Berrange, 2016/03/22
[Qemu-devel] [PATCH v3 07/10] qemu-nbd: add support for ACLs for TLS clients, Daniel P. Berrange, 2016/03/10
[Qemu-devel] [PATCH v3 04/10] util: add QAuthZ object as an authorization base class, Daniel P. Berrange, 2016/03/10
[Qemu-devel] [PATCH v3 09/10] chardev: add support for ACLs for TLS clients, Daniel P. Berrange, 2016/03/10
[Qemu-devel] [PATCH v3 05/10] util: add QAuthZSimple object type for a simple access control list, Daniel P. Berrange, 2016/03/10