From nobody Tue May 7 03:08:30 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1567876932; cv=none; d=zoho.com; s=zohoarc; b=FYi+IkspwEOqOUY4TsqjGiNB3tHRfei+4n5dENTuKZXw/z6xa2s9+XqgZRMWvwjSs1LOR9YfGDTg6l2UCFH3/2/kzdroKWpbuEFUoy1RNTFMPZE0qh7Z15J+CCs4F62C/4KoXyBh7vxjyc6wArJCdCk/5DVz/9l8NAETSlRFxPY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1567876932; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To:ARC-Authentication-Results; bh=+xBojWuWHi0Drb5bRiRiATC7+hKmKqoHLu2ukmEXrHo=; b=Xanli+/8dZe9ZQTX4os9n7V7/bDc86jWlJgnxxwpxbcTqnDYpnz+7aCDqksUOg4FoT14HOSH3LS0p6XcTmZ4MqM7HHAx3bzhtSwKhQOz3Q5WQPxm4PrDwFPIa0smXtsk2Cc4HvfdiemwFEqOd4BzaVs/ne5WlBkoqVnVgVJv324= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (209.51.188.17 [209.51.188.17]) by mx.zohomail.com with SMTPS id 1567876932240285.78221039990717; Sat, 7 Sep 2019 10:22:12 -0700 (PDT) Received: from localhost ([::1]:36378 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1i6ePT-00057F-A9 for importer@patchew.org; Sat, 07 Sep 2019 13:22:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:34651) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1i6eOX-0004eX-8C for qemu-devel@nongnu.org; Sat, 07 Sep 2019 13:21:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1i6eOV-0002bZ-Qy for qemu-devel@nongnu.org; Sat, 07 Sep 2019 13:21:05 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60552) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1i6eOS-0002Wc-88; Sat, 07 Sep 2019 13:21:00 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D1101A46C04; Sat, 7 Sep 2019 17:20:58 +0000 (UTC) Received: from blue.redhat.com (ovpn-116-234.phx2.redhat.com [10.3.116.234]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5755260925; Sat, 7 Sep 2019 17:20:58 +0000 (UTC) From: Eric Blake To: qemu-devel@nongnu.org Date: Sat, 7 Sep 2019 12:20:55 -0500 Message-Id: <20190907172055.26870-1-eblake@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (mx1.redhat.com [10.5.110.68]); Sat, 07 Sep 2019 17:20:58 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH] nbd/client: Add hint when TLS is missing X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?Daniel=20P=20=2E=20Berrang=C3=A9?= , "open list:Network Block Dev..." , Tingting Mao Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" I received an off-list report of failure to connect to an NBD server expecting an x509 certificate, when the client was attempting something similar to this command line: $ ./x86_64-softmmu/qemu-system-x86_64 -name 'blah' -machine q35 -nodefaults= \ -object tls-creds-x509,id=3Dtls0,endpoint=3Dclient,dir=3D$path_to_certs \ -device virtio-scsi-pci,id=3Dvirtio_scsi_pci0,bus=3Dpcie.0,addr=3D0x6 \ -drive id=3Ddrive_image1,if=3Dnone,snapshot=3Doff,aio=3Dthreads,cache=3Dn= one,format=3Draw,file=3Dnbd:localhost:9000,werror=3Dstop,rerror=3Dstop,tls-= creds=3Dtls0 \ -device scsi-hd,id=3Dimage1,drive=3Ddrive_image1,bootindex=3D0 qemu-system-x86_64: -drive id=3Ddrive_image1,if=3Dnone,snapshot=3Doff,aio= =3Dthreads,cache=3Dnone,format=3Draw,file=3Dnbd:localhost:9000,werror=3Dsto= p,rerror=3Dstop,tls-creds=3Dtls0: TLS negotiation required before option 7 = (go) server reported: Option 0x7 not permitted before TLS The problem? As specified, -drive is trying to pass tls-creds to the raw format driver instead of the nbd protocol driver, but before we get to the point where we can detect that raw doesn't know what to do with tls-creds, the nbd driver has already failed because the server complained. The fix to the broken command line? Pass '...,file.tls-creds=3Dtls0' to ensure the tls-creds option is handed to nbd, not raw. But since the error message was rather cryptic, I'm trying to improve the error message. With this patch, the error message adds a line: qemu-system-x86_64: -drive id=3Ddrive_image1,if=3Dnone,snapshot=3Doff,aio= =3Dthreads,cache=3Dnone,format=3Draw,file=3Dnbd:localhost:9000,werror=3Dsto= p,rerror=3Dstop,tls-creds=3Dtls0: TLS negotiation required before option 7 = (go) Did you forget a valid tls-creds? server reported: Option 0x7 not permitted before TLS And with luck, someone grepping for that error message will find this commit message and figure out their command line mistake. Sadly, the only mention of file.tls-creds in our docs relates to an --image-opts use of PSK encryption with qemu-img as the client, rather than x509 certificate encryption with qemu-kvm as the client. CC: Tingting Mao CC: Daniel P. Berrang=C3=A9 Signed-off-by: Eric Blake Reviewed-by: Daniel P. Berrang=C3=A9 --- nbd/client.c | 1 + 1 file changed, 1 insertion(+) diff --git a/nbd/client.c b/nbd/client.c index b9dc829175f9..f6733962b49b 100644 --- a/nbd/client.c +++ b/nbd/client.c @@ -204,6 +204,7 @@ static int nbd_handle_reply_err(QIOChannel *ioc, NBDOpt= ionReply *reply, case NBD_REP_ERR_TLS_REQD: error_setg(errp, "TLS negotiation required before option %" PRIu32 " (%s)", reply->option, nbd_opt_lookup(reply->option)); + error_append_hint(errp, "Did you forget a valid tls-creds?\n"); break; case NBD_REP_ERR_UNKNOWN: --=20 2.21.0