From nobody Mon Feb 9 03:13:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 164632432057956.34506860650333; Thu, 3 Mar 2022 08:18:40 -0800 (PST) Received: from localhost ([::1]:55536 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1nPoA2-00074z-UQ for importer@patchew.org; Thu, 03 Mar 2022 11:18:38 -0500 Received: from eggs.gnu.org ([209.51.188.92]:59856) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nPnwM-0007ng-El for qemu-devel@nongnu.org; Thu, 03 Mar 2022 11:04:30 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]:57276) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nPnwJ-000791-VD for qemu-devel@nongnu.org; Thu, 03 Mar 2022 11:04:30 -0500 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-382-IKJBn3K1P0uQeFbhbFxCrg-1; Thu, 03 Mar 2022 11:04:23 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id F37421091DA0; Thu, 3 Mar 2022 16:04:21 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.33.36.83]) by smtp.corp.redhat.com (Postfix) with ESMTP id D0249106D5A7; Thu, 3 Mar 2022 16:04:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1646323467; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=p0ltbwDkzNCd5ygKmbkLH5iWRJG7bSqyMlG+iy4ITOQ=; b=ZQ2FSXAWCNMOtIgQq4yhzcSe928k+SnAYL2hJHwN7OLnCmFWTTD2nsfT41ZxmUw/i7DxEY qYxkPbuQV+FNb7Z0T6j21SmEcdcbJAAZhw7bGaprI1Q1nsZ0xTF1iEtJwPl/ZYrghlO+KQ BdSi3y3TaqEn86e/EvHKr+1QzxKHFxk= X-MC-Unique: IKJBn3K1P0uQeFbhbFxCrg-1 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Subject: [PATCH 03/12] block/nbd: support override of hostname for TLS certificate validation Date: Thu, 3 Mar 2022 16:03:21 +0000 Message-Id: <20220303160330.2979753-4-berrange@redhat.com> In-Reply-To: <20220303160330.2979753-1-berrange@redhat.com> References: <20220303160330.2979753-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=berrange@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -28 X-Spam_score: -2.9 X-Spam_bar: -- X-Spam_report: (-2.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.082, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Vladimir Sementsov-Ogievskiy , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , qemu-block@nongnu.org, Markus Armbruster , Hanna Reitz , Eric Blake Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1646324321100100001 When connecting to an NBD server with TLS and x509 credentials, the client must validate the hostname it uses for the connection, against that published in the server's certificate. If the client is tunnelling its connection over some other channel, however, the hostname it uses may not match the info reported in the server's certificate. In such a case, the user needs to explicitly set an override for the hostname to use for certificate validation. This is achieved by adding a 'tls-hostname' property to the NBD block driver. Signed-off-by: Daniel P. Berrang=C3=A9 Reviewed-by: Eric Blake --- block/nbd.c | 18 +++++++++++++++--- qapi/block-core.json | 3 +++ 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/block/nbd.c b/block/nbd.c index dd43929207..113aa5d3af 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -90,9 +90,10 @@ typedef struct BDRVNBDState { uint32_t reconnect_delay; uint32_t open_timeout; SocketAddress *saddr; - char *export, *tlscredsid; + char *export; + char *tlscredsid; QCryptoTLSCreds *tlscreds; - const char *tlshostname; + char *tlshostname; char *x_dirty_bitmap; bool alloc_depth; =20 @@ -121,6 +122,8 @@ static void nbd_clear_bdrvstate(BlockDriverState *bs) s->export =3D NULL; g_free(s->tlscredsid); s->tlscredsid =3D NULL; + g_free(s->tlshostname); + s->tlshostname =3D NULL; g_free(s->x_dirty_bitmap); s->x_dirty_bitmap =3D NULL; } @@ -1764,6 +1767,11 @@ static QemuOptsList nbd_runtime_opts =3D { .type =3D QEMU_OPT_STRING, .help =3D "ID of the TLS credentials to use", }, + { + .name =3D "tls-hostname", + .type =3D QEMU_OPT_STRING, + .help =3D "Override hostname for validating TLS x509 certifica= te", + }, { .name =3D "x-dirty-bitmap", .type =3D QEMU_OPT_STRING, @@ -1835,7 +1843,10 @@ static int nbd_process_options(BlockDriverState *bs,= QDict *options, error_setg(errp, "TLS only supported over IP sockets"); goto error; } - s->tlshostname =3D s->saddr->u.inet.host; + s->tlshostname =3D g_strdup(qemu_opt_get(opts, "tls-hostname")); + if (!s->tlshostname) { + s->tlshostname =3D g_strdup(s->saddr->u.inet.host); + } } =20 s->x_dirty_bitmap =3D g_strdup(qemu_opt_get(opts, "x-dirty-bitmap")); @@ -2037,6 +2048,7 @@ static const char *const nbd_strong_runtime_opts[] = =3D { "port", "export", "tls-creds", + "tls-hostname", "server.", =20 NULL diff --git a/qapi/block-core.json b/qapi/block-core.json index 9a5a3641d0..c1b0435f57 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -4078,6 +4078,8 @@ # # @tls-creds: TLS credentials ID # +# @tls-hostname: TLS hostname override for certificate validation +# # @x-dirty-bitmap: A metadata context name such as "qemu:dirty-bitmap:NAME" # or "qemu:allocation-depth" to query in place of the # traditional "base:allocation" block status (see @@ -4108,6 +4110,7 @@ 'data': { 'server': 'SocketAddress', '*export': 'str', '*tls-creds': 'str', + '*tls-hostname': 'str', '*x-dirty-bitmap': { 'type': 'str', 'features': [ 'unstable' ]= }, '*reconnect-delay': 'uint32', '*open-timeout': 'uint32' } } --=20 2.34.1