[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v3 00/13] Implement TLS support to QEMU NBD server &
From: |
Daniel P. Berrange |
Subject: |
[Qemu-devel] [PATCH v3 00/13] Implement TLS support to QEMU NBD server & client |
Date: |
Tue, 19 Jan 2016 13:09:10 +0000 |
This is an update of the series previously posted:
v1: https://lists.gnu.org/archive/html/qemu-devel/2015-11/msg06126.html
v2: https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg01580.html
This series of patches implements support for TLS in the QEMU NBD
server and client code.
It is implementing the NBD_OPT_STARTTLS option that was previously
discussed here:
https://www.redhat.com/archives/libvir-list/2014-October/msg00506.html
And is also described in the NBD spec here:
https://github.com/yoe/nbd/blob/master/doc/proto.md
To ensure that clients always get a suitable error message from the
NBD server when it is configured with TLS, a client speaking the
new style protocol will always send NBD_OPT_LIST as the first thing
it does, so that we can see the NBD_REP_ERR_TLS_REQD response. This
should all be backwards & forwards compatible with previous QEMU
impls of NBD
Usage of TLS is described in the commit messages for each patch,
but for sake of people who don't want to explore the series, here's
the summary
Starting QEMU system emulator with a disk backed by an TLS encrypted
NBD export
$ qemu-system-x86_64 \
-object
tls-creds-x509,id=tls0,endpoint=client,dir=/home/berrange/security/qemutls \
-drive driver=nbd,host=localhost,port=9000,tls-creds=tls0
Starting a standalone NBD server providing a TLS encrypted NBD export
$ qemu-nbd \
--object
tls-creds-x509,id=tls0,endpoint=server,dir=/home/berrange/security/qemutls
--tls-creds tls0 \
--exportname default \
$IMAGEFILE
NB, exportname is mandatory, since TLS requires the fixed-new style
NBD protocol negotiation.
Starting a QEMU system emulator built-in NBD server
$ qemu-system-x86_64 \
-qmp unix:/tmp/qmp,server \
-hda /home/berrange/Fedora-Server-netinst-x86_64-23.iso \
-object
tls-creds-x509,id=tls0,dir=/home/berrange/security/qemutls,endpoint=server
$ qmp-shell /tmp/qmp
(qmp) nbd-server-start addr={"host":"localhost","port":"9000"} tls-creds=tls0
(qmp) nbd-server-add device=ide0-hd0
This series depends on this bug fix I recently sent:
https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03406.html
And the qemu-nbd/etc command line options work
https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03381.html
The first 4 patches are the conversion to the I/O channels
framework.
The next 5 patches are general tweaks to QEMU's impl of the
NBD protocol for better compliance and/or future proofing.
The next patch provides the NBD protocol TLS implementation.
The final 3 patches allow TLS to be enabled in the QEMU NBD
client and servers.
Changed in v3:
- Rebase to resolve conflicts with recently merged NBD patches
Changed in v2:
- Fix error codes used during NBD TLS option negotiate
- Update patch with helpers for UserCreatable object types
Daniel P. Berrange (13):
nbd: convert block client to use I/O channels for connection setup
nbd: convert qemu-nbd server to use I/O channels for connection setup
nbd: convert blockdev NBD server to use I/O channels for connection
setup
nbd: convert to using I/O channels for actual socket I/O
nbd: invert client logic for negotiating protocol version
nbd: make server compliant with fixed newstyle spec
nbd: make client request fixed new style if advertized
nbd: allow setting of an export name for qemu-nbd server
nbd: pick first exported volume if no export name is requested
nbd: implement TLS support in the protocol negotiation
nbd: enable use of TLS with NBD block driver
nbd: enable use of TLS with qemu-nbd server
nbd: enable use of TLS with nbd-server-start command
Makefile | 6 +-
block/nbd-client.c | 74 +++++----
block/nbd-client.h | 10 +-
block/nbd.c | 105 ++++++++++---
blockdev-nbd.c | 131 +++++++++++++---
hmp.c | 2 +-
include/block/nbd.h | 28 +++-
nbd/client.c | 442 +++++++++++++++++++++++++++++++++++++++++++++-------
nbd/common.c | 125 ++++++++++++---
nbd/nbd-internal.h | 32 ++--
nbd/server.c | 333 ++++++++++++++++++++++++++++-----------
qapi/block.json | 4 +-
qemu-nbd.c | 158 ++++++++++++++-----
qemu-nbd.texi | 7 +
qmp-commands.hx | 2 +-
tests/Makefile | 2 +-
16 files changed, 1152 insertions(+), 309 deletions(-)
--
2.5.0
- [Qemu-devel] [PATCH v3 00/13] Implement TLS support to QEMU NBD server & client,
Daniel P. Berrange <=
- [Qemu-devel] [PATCH v3 03/13] nbd: convert blockdev NBD server to use I/O channels for connection setup, Daniel P. Berrange, 2016/01/19
- [Qemu-devel] [PATCH v3 02/13] nbd: convert qemu-nbd server to use I/O channels for connection setup, Daniel P. Berrange, 2016/01/19
- [Qemu-devel] [PATCH v3 01/13] nbd: convert block client to use I/O channels for connection setup, Daniel P. Berrange, 2016/01/19
- [Qemu-devel] [PATCH v3 07/13] nbd: make client request fixed new style if advertized, Daniel P. Berrange, 2016/01/19
- [Qemu-devel] [PATCH v3 06/13] nbd: make server compliant with fixed newstyle spec, Daniel P. Berrange, 2016/01/19
- [Qemu-devel] [PATCH v3 08/13] nbd: allow setting of an export name for qemu-nbd server, Daniel P. Berrange, 2016/01/19
- [Qemu-devel] [PATCH v3 04/13] nbd: convert to using I/O channels for actual socket I/O, Daniel P. Berrange, 2016/01/19