[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v6] crypto: Implement TLS Pre-Shared Keys (PSK).
From: |
Daniel P . Berrangé |
Subject: |
Re: [Qemu-devel] [PATCH v6] crypto: Implement TLS Pre-Shared Keys (PSK). |
Date: |
Tue, 3 Jul 2018 12:17:23 +0100 |
User-agent: |
Mutt/1.10.0 (2018-05-17) |
On Tue, Jul 03, 2018 at 09:03:03AM +0100, Richard W.M. Jones wrote:
> Pre-Shared Keys (PSK) is a simpler mechanism for enabling TLS
> connections than using certificates. It requires only a simple secret
> key:
>
> $ mkdir -m 0700 /tmp/keys
> $ psktool -u rjones -p /tmp/keys/keys.psk
> $ cat /tmp/keys/keys.psk
> rjones:d543770c15ad93d76443fb56f501a31969235f47e999720ae8d2336f6a13fcbc
>
> The key can be secretly shared between clients and servers. Clients
> must specify the directory containing the "keys.psk" file and a
> username (defaults to "qemu"). Servers must specify only the
> directory.
>
> Example NBD client:
>
> $ qemu-img info \
> --object
> tls-creds-psk,id=tls0,dir=/tmp/keys,username=rjones,endpoint=client \
> --image-opts \
>
> file.driver=nbd,file.host=localhost,file.port=10809,file.tls-creds=tls0,file.export=/
>
> Example NBD server using qemu-nbd:
>
> $ qemu-nbd -t -x / \
> --object tls-creds-psk,id=tls0,endpoint=server,dir=/tmp/keys \
> --tls-creds tls0 \
> image.qcow2
>
> Example NBD server using nbdkit:
>
> $ nbdkit -n -e / -fv \
> --tls=on --tls-psk=/tmp/keys/keys.psk \
> file file=disk.img
>
> Signed-off-by: Richard W.M. Jones <address@hidden>
> ---
> crypto/Makefile.objs | 1 +
> crypto/tlscredspsk.c | 308 +++++++++++++++++++++++++++++++++
> crypto/tlssession.c | 56 +++++-
> crypto/trace-events | 3 +
> include/crypto/tlscredspsk.h | 106 ++++++++++++
> qemu-doc.texi | 37 ++++
> qemu-options.hx | 24 +++
> tests/Makefile.include | 4 +-
> tests/crypto-tls-psk-helpers.c | 50 ++++++
> tests/crypto-tls-psk-helpers.h | 29 ++++
> tests/test-crypto-tlssession.c | 185 +++++++++++++++++---
> 11 files changed, 777 insertions(+), 26 deletions(-)
Signed-off-by: Daniel P. Berrangé <address@hidden>
I'll send a pull request with it shortly
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|