Daniel P. Berrange b25e12daff qemu-nbd: add support for authorization of TLS clients
Currently any client which can complete the TLS handshake is able to use
the NBD server. The server admin can turn on the 'verify-peer' option
for the x509 creds to require the client to provide a x509 certificate.
This means the client will have to acquire a certificate from the CA
before they are permitted to use the NBD server. This is still a fairly
low bar to cross.

This adds a '--tls-authz OBJECT-ID' option to the qemu-nbd command which
takes the ID of a previously added 'QAuthZ' object instance. This will
be used to validate the client's x509 distinguished name. Clients
failing the authorization check will not be permitted to use the NBD
server.

For example to setup authorization that only allows connection from a client
whose x509 certificate distinguished name is

   CN=laptop.example.com,O=Example Org,L=London,ST=London,C=GB

escape the commas in the name and use:

  qemu-nbd --object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
                    endpoint=server,verify-peer=yes \
           --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\
                     O=Example Org,,L=London,,ST=London,,C=GB' \
           --tls-creds tls0 \
           --tls-authz authz0 \
	   ....other qemu-nbd args...

NB: a real shell command line would not have leading whitespace after
the line continuation, it is just included here for clarity.

Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <20190227162035.18543-2-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: split long line in --help text, tweak 233 to show that whitespace
after ,, in identity= portion is actually okay]
Signed-off-by: Eric Blake <eblake@redhat.com>
2019-03-06 11:05:27 -06:00
..
2018-01-23 12:34:43 +01:00
2017-07-11 17:45:02 +02:00
045
2019-02-25 15:11:28 +01:00
055
2018-03-19 12:01:24 +01:00
2018-03-19 12:01:24 +01:00
2018-02-13 12:27:17 +01:00
2015-01-23 12:41:32 -05:00
2017-05-11 12:08:24 +02:00
2017-09-06 15:19:01 +01:00
2018-11-05 15:17:48 +01:00
2018-03-19 14:58:36 -05:00
2018-05-23 14:30:51 +02:00
2018-01-23 12:34:42 +01:00
110
2019-02-25 15:11:27 +01:00
2018-06-11 16:18:45 +02:00
2017-07-10 13:18:05 +02:00
2017-10-26 15:01:14 +02:00
2018-05-23 13:29:03 +02:00
129
2018-03-09 15:40:07 +01:00
132
2018-03-09 15:40:07 +01:00
2016-05-19 16:45:31 +02:00
2018-05-23 14:30:51 +02:00
147
2019-01-31 00:44:55 +01:00
148
2018-03-09 15:40:07 +01:00
2018-06-18 17:05:17 +02:00
152
2018-03-09 15:40:07 +01:00
155
2018-05-23 14:30:51 +02:00
2016-09-20 22:10:57 +02:00
2016-09-20 22:10:57 +02:00
2017-09-26 15:00:32 +02:00
169
2018-10-30 21:13:54 -03:00
2016-09-20 22:10:57 +02:00
2017-09-18 19:43:38 -04:00
2017-02-12 00:47:42 +01:00
194
2018-04-10 16:33:43 +02:00
199
2018-03-13 17:06:32 -04:00
209
2018-03-13 15:44:09 -05:00
210
2019-02-25 15:11:27 +01:00
211
2019-02-25 15:11:28 +01:00
212
2019-02-25 15:11:27 +01:00
213
2019-02-25 15:11:27 +01:00
2018-05-15 16:15:21 +02:00
218
2018-10-26 17:17:32 +02:00
219
2018-06-11 16:18:45 +02:00
222
2018-07-10 11:55:11 +02:00
228
2019-02-25 15:11:27 +01:00
2019-02-25 15:11:27 +01:00
232
2019-02-25 15:11:28 +01:00
234
2019-02-01 13:46:44 +01:00
2019-02-01 13:46:44 +01:00
237
2019-02-25 15:11:27 +01:00
239
2019-02-01 13:46:44 +01:00
2019-02-01 13:46:44 +01:00
2019-02-11 14:35:43 -06:00
2019-02-01 13:46:44 +01:00
2019-02-25 15:11:28 +01:00

=== This is the QEMU I/O test suite ===

* Intro

This package contains a simple test suite for the I/O layer of qemu.
It does not require a guest, but only the qemu, qemu-img and qemu-io
binaries.  This does limit it to exercise the low-level I/O path only
but no actual block drivers like ide, scsi or virtio.

* Usage

Just run ./check to run all tests for the raw image format, or ./check
-qcow2 to test the qcow2 image format.  The output of ./check -h explains
additional options to test further image formats or I/O methods.

* Feedback and patches

Please send improvements to the test suite, general feedback or just
reports of failing tests cases to qemu-devel@nongnu.org with a CC:
to qemu-block@nongnu.org.