Re: [Qemu-devel] [PATCH v3 07/10] qemu-nbd: add support for ACLs for TLS clients

[Daniel P. Berrange]

On Tue, Mar 22, 2016 at 12:14:27PM -0600, Eric Blake wrote:
> On 03/10/2016 11:59 AM, Daniel P. Berrange wrote:
> > Currently any client which can complete the TLS handshake
> > is able to use the NBD server. The server admin can turn
> > on the 'verify-peer' option for the x509 creds to require
> > the client to provide a x509 certificate. This means the
> > client will have to acquire a certificate from the CA before
> > they are permitted to use the NBD server. This is still a
> > fairly weak bar.
> > 
> > This adds a '--tls-acl ACL-ID' option to the qemu-nbd command
> > which takes the ID of a previously added 'QAuthZ' object
> > instance. This ACL will be used to validate the client's
> > x509 distinguished name. Clients failing the ACL will not be
> > permitted to use the NBD server.
> > 
> > For example to setup an ACL that only allows connection from
> > a client whose x509 certificate distinguished name contains
> > 'CN=fred', you would use:
> > 
> >   qemu-nbd -object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
> >                    endpoint=server,verify-peer=yes \
> >            -object authz-simple,id=acl0,policy=deny,\
> >                rules.0.match=*CN=fred,rules.0.policy=allow \
> >            -tls-creds tls0 \
> >            -tls-acl acl0
> >        ....other qemu-nbd args...
> 
> Ah, so you are arguing that this is feature-completion of work started
> in 2.6, continuing work started before soft-freeze, and not a new
> feature to be delayed to 2.7.

Yes and v1 of this patch series was in fact posted just a few days
before the soft-freeze deadline.

That said, as mentioned in the earlier patch, I'm open minded about
whether this goes in 2.6 or 2.7. It would be nice to have in 2.6
but not the end of the world if it misses it, as overall we're still
waaaaaaaay better off compared to 2.5 even if this doesn't mege :-)



Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|