[v2] nbd: enable use of TLS on non-TCP transports and other TLS improvements

[PATCH v2 00/12] nbd: enable use of TLS on non-TCP transports and other TLS improvements

Daniel P. Berrangé posted 12 patches 2 years, 1 month ago

Diff against v1
Download series mbox

Test checkpatch passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20220304193610.3293146-1-berrange@redhat.com

Maintainers: Eric Blake <eblake@redhat.com>, Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>, Kevin Wolf <kwolf@redhat.com>, Hanna Reitz <hreitz@redhat.com>, "Daniel P. Berrangé" <berrange@redhat.com>, Markus Armbruster <armbru@redhat.com>

block/nbd.c                      | 25 +++++---
blockdev-nbd.c                   |  6 --
crypto/tlssession.c              |  6 ++
docs/tools/qemu-nbd.rst          | 13 +++++
include/block/nbd.h              |  3 +-
nbd/client-connection.c          | 12 +++-
qapi/block-core.json             |  3 +
qemu-nbd.c                       | 25 ++++++--
tests/qemu-iotests/233           | 99 +++++++++++++++++++++++++++-----
tests/qemu-iotests/233.out       | 56 +++++++++++++++---
tests/qemu-iotests/241           |  6 +-
tests/qemu-iotests/241.out       |  6 ++
tests/qemu-iotests/common.filter |  9 +++
tests/qemu-iotests/common.tls    | 31 +++++++++-
tests/qemu-iotests/testrunner.py |  6 ++
15 files changed, 255 insertions(+), 51 deletions(-)

Expand all Fold all

[PATCH v2 00/12] nbd: enable use of TLS on non-TCP transports and other TLS improvements

Posted by Daniel P. Berrangé 2 years, 1 month ago

This series was principally motivated by a desire to enabl use of TLS
on non-TCP transports. For x509 certificates this means we need a way
to set the hostname to use for validation. This also lets us override
the hostname when connecting on a TCP transport that is tunnelled or
port-forwarded. It also unlocks the ability to use PSK (pre-shared
keys) with UNIX sockets which would always have worked, had it not
been blocked by explicit checks in NBD code.

NB, the first patch in this series is common with my corresponding
migration series for TLS

  https://lists.gnu.org/archive/html/qemu-devel/2022-03/msg00556.html

In v2:

  - Tweak the filter for qemu-nbd export list to expose export name
  - Add "since" tag to QAPI addition
  - Minor docs fixes

Daniel P. Berrangé (12):
  crypto: mandate a hostname when checking x509 creds on a client
  block: pass desired TLS hostname through from block driver client
  block/nbd: support override of hostname for TLS certificate validation
  qemu-nbd: add --tls-hostname option for TLS certificate validation
  block/nbd: don't restrict TLS usage to IP sockets
  tests/qemu-iotests: add QEMU_IOTESTS_REGEN=1 to update reference file
  tests/qemu-iotests: expand _filter_nbd rules
  tests/qemu-iotests: introduce filter for qemu-nbd export list
  tests/qemu-iotests: convert NBD TLS test to use standard filters
  tests/qemu-iotests: validate NBD TLS with hostname mismatch
  tests/qemu-iotests: validate NBD TLS with UNIX sockets
  tests/qemu-iotests: validate NBD TLS with UNIX sockets and PSK

 block/nbd.c                      | 25 +++++---
 blockdev-nbd.c                   |  6 --
 crypto/tlssession.c              |  6 ++
 docs/tools/qemu-nbd.rst          | 13 +++++
 include/block/nbd.h              |  3 +-
 nbd/client-connection.c          | 12 +++-
 qapi/block-core.json             |  3 +
 qemu-nbd.c                       | 25 ++++++--
 tests/qemu-iotests/233           | 99 +++++++++++++++++++++++++++-----
 tests/qemu-iotests/233.out       | 56 +++++++++++++++---
 tests/qemu-iotests/241           |  6 +-
 tests/qemu-iotests/241.out       |  6 ++
 tests/qemu-iotests/common.filter |  9 +++
 tests/qemu-iotests/common.tls    | 31 +++++++++-
 tests/qemu-iotests/testrunner.py |  6 ++
 15 files changed, 255 insertions(+), 51 deletions(-)

-- 
2.34.1