From nobody Mon Feb 9 20:31:15 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1529498518506558.9559784418312; Wed, 20 Jun 2018 05:41:58 -0700 (PDT) Received: from localhost ([::1]:49195 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fVcQv-0006ym-Jo for importer@patchew.org; Wed, 20 Jun 2018 08:41:57 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36761) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fVc0V-0000ZL-6u for qemu-devel@nongnu.org; Wed, 20 Jun 2018 08:14:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fVc0S-0008HO-0w for qemu-devel@nongnu.org; Wed, 20 Jun 2018 08:14:39 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:56300 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fVc0O-0008Ey-Ep; Wed, 20 Jun 2018 08:14:32 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 225707A7ED; Wed, 20 Jun 2018 12:14:32 +0000 (UTC) Received: from t460.redhat.com (unknown [10.33.36.101]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4B76C2026D6B; Wed, 20 Jun 2018 12:14:30 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Date: Wed, 20 Jun 2018 13:14:20 +0100 Message-Id: <20180620121423.16979-4-berrange@redhat.com> In-Reply-To: <20180620121423.16979-1-berrange@redhat.com> References: <20180620121423.16979-1-berrange@redhat.com> X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Wed, 20 Jun 2018 12:14:32 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Wed, 20 Jun 2018 12:14:32 +0000 (UTC) for IP:'10.11.54.4' DOMAIN:'int-mx04.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'berrange@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v2 3/6] migration: add support for a "tls-authz" migration parameter X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , qemu-block@nongnu.org, Juan Quintela , Markus Armbruster , "Dr. David Alan Gilbert" , Max Reitz , Gerd Hoffmann , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: "Daniel P. Berrange" The QEMU instance that runs as the server for the migration data transport (ie the target QEMU) needs to be able to configure access control so it can prevent unauthorized clients initiating an incoming migration. This adds a new 'tls-authz' migration parameter that is used to provide the QOM ID of a QAuthZ subclass instance that provides the access control check. This is checked against the x509 certificate obtained during the TLS handshake. For example, when starting a QEMU for incoming migration, it is possible to give an example identity of the source QEMU that is intended to be connecting later: $QEMU \ -monitor stdio \ -incoming defer \ ...other args... (qemu) object_add tls-creds-x509,id=3Dtls0,dir=3D/home/berrange/qemutls,\ endpoint=3Dserver,verify-peer=3Dyes \ (qemu) object_add authz-simple,id=3Dauth0,identity=3DCN=3Dlaptop.example.= com,,\ O=3DExample Org,,L=3DLondon,,ST=3DLondon,,C=3DGB \ (qemu) migrate_incoming tcp:localhost:9000 Signed-off-by: Daniel P. Berrange --- hmp.c | 9 +++++++++ migration/migration.c | 8 ++++++++ migration/tls.c | 2 +- qapi/migration.json | 14 +++++++++++++- 4 files changed, 31 insertions(+), 2 deletions(-) diff --git a/hmp.c b/hmp.c index b93a871830..b0a7f3a2fb 100644 --- a/hmp.c +++ b/hmp.c @@ -373,6 +373,9 @@ void hmp_info_migrate_parameters(Monitor *mon, const QD= ict *qdict) monitor_printf(mon, "%s: %" PRIu64 "\n", MigrationParameter_str(MIGRATION_PARAMETER_MAX_POSTCOPY_BANDWI= DTH), params->max_postcopy_bandwidth); + monitor_printf(mon, " %s: '%s'\n", + MigrationParameter_str(MIGRATION_PARAMETER_TLS_AUTHZ), + params->has_tls_authz ? params->tls_authz : ""); } =20 qapi_free_MigrationParameters(params); @@ -1635,6 +1638,12 @@ void hmp_migrate_set_parameter(Monitor *mon, const Q= Dict *qdict) p->tls_hostname->type =3D QTYPE_QSTRING; visit_type_str(v, param, &p->tls_hostname->u.s, &err); break; + case MIGRATION_PARAMETER_TLS_AUTHZ: + p->has_tls_authz =3D true; + p->tls_authz =3D g_new0(StrOrNull, 1); + p->tls_authz->type =3D QTYPE_QSTRING; + visit_type_str(v, param, &p->tls_authz->u.s, &err); + break; case MIGRATION_PARAMETER_MAX_BANDWIDTH: p->has_max_bandwidth =3D true; /* diff --git a/migration/migration.c b/migration/migration.c index e1eaa97df4..40df9a9bc3 100644 --- a/migration/migration.c +++ b/migration/migration.c @@ -650,6 +650,8 @@ MigrationParameters *qmp_query_migrate_parameters(Error= **errp) params->tls_creds =3D g_strdup(s->parameters.tls_creds); params->has_tls_hostname =3D true; params->tls_hostname =3D g_strdup(s->parameters.tls_hostname); + params->has_tls_authz =3D true; + params->tls_authz =3D g_strdup(s->parameters.tls_authz); params->has_max_bandwidth =3D true; params->max_bandwidth =3D s->parameters.max_bandwidth; params->has_downtime_limit =3D true; @@ -1116,6 +1118,12 @@ static void migrate_params_apply(MigrateSetParameter= s *params, Error **errp) s->parameters.tls_hostname =3D g_strdup(params->tls_hostname->u.s); } =20 + if (params->has_tls_authz) { + g_free(s->parameters.tls_authz); + assert(params->tls_authz->type =3D=3D QTYPE_QSTRING); + s->parameters.tls_authz =3D g_strdup(params->tls_authz->u.s); + } + if (params->has_max_bandwidth) { s->parameters.max_bandwidth =3D params->max_bandwidth; if (s->to_dst_file) { diff --git a/migration/tls.c b/migration/tls.c index 3b9e8c9263..5171afc6c4 100644 --- a/migration/tls.c +++ b/migration/tls.c @@ -94,7 +94,7 @@ void migration_tls_channel_process_incoming(MigrationStat= e *s, =20 tioc =3D qio_channel_tls_new_server( ioc, creds, - NULL, /* XXX pass ACL name */ + s->parameters.tls_authz, errp); if (!tioc) { return; diff --git a/qapi/migration.json b/qapi/migration.json index 1b4c1db670..3fe0d0c949 100644 --- a/qapi/migration.json +++ b/qapi/migration.json @@ -488,6 +488,12 @@ # hostname must be provided so that the server's x509 # certificate identity can be validated. (Since 2.7) # +# @tls-authz: ID of the 'authz' object subclass that provides access contr= ol +# checking of the TLS x509 certificate distinguished name. +# This object is only resolved at time of use, so can be delet= ed +# and recreated on the fly while the migration server is activ= e. +# If missing, it will default to denying access (Since 3.0) +# # @max-bandwidth: to set maximum speed for migration. maximum speed in # bytes per second. (Since 2.8) # @@ -525,7 +531,7 @@ { 'enum': 'MigrationParameter', 'data': ['compress-level', 'compress-threads', 'decompress-threads', 'cpu-throttle-initial', 'cpu-throttle-increment', - 'tls-creds', 'tls-hostname', 'max-bandwidth', + 'tls-creds', 'tls-hostname', 'tls-authz', 'max-bandwidth', 'downtime-limit', 'x-checkpoint-delay', 'block-incremental', 'x-multifd-channels', 'x-multifd-page-count', 'xbzrle-cache-size', 'max-postcopy-bandwidth' ] } @@ -612,6 +618,7 @@ '*cpu-throttle-increment': 'int', '*tls-creds': 'StrOrNull', '*tls-hostname': 'StrOrNull', + '*tls-authz': 'StrOrNull', '*max-bandwidth': 'int', '*downtime-limit': 'int', '*x-checkpoint-delay': 'int', @@ -675,6 +682,10 @@ # associated with the migration URI, if any. (Since 2.9) # Note: 2.8 reports this by omitting tls-hostname instead. # +# @tls-authz: ID of the 'authz' object subclass that provides access contr= ol +# checking of the TLS x509 certificate distinguished name. (Si= nce +# 3.0) +# # @max-bandwidth: to set maximum speed for migration. maximum speed in # bytes per second. (Since 2.8) # @@ -716,6 +727,7 @@ '*cpu-throttle-increment': 'uint8', '*tls-creds': 'str', '*tls-hostname': 'str', + '*tls-authz': 'str', '*max-bandwidth': 'size', '*downtime-limit': 'uint64', '*x-checkpoint-delay': 'uint32', --=20 2.17.0