[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [PATCH v6 00/16] Implement TLS support to QEMU NBD serv
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-block] [PATCH v6 00/16] Implement TLS support to QEMU NBD server & client |
Date: |
Tue, 16 Feb 2016 17:18:07 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 |
On 10/02/2016 19:40, Daniel P. Berrange wrote:
> This is an update of the series previously posted:
>
> v1: https://lists.gnu.org/archive/html/qemu-devel/2015-11/msg06126.html
> v2: https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg01580.html
> v3: https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03440.html
> v4:
> https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg04160.html
>
> This series of patches implements support for TLS in the QEMU NBD
> server and client code.
>
> It is implementing the NBD_OPT_STARTTLS option that was previously
> discussed here:
>
> https://www.redhat.com/archives/libvir-list/2014-October/msg00506.html
>
> And is also described in the NBD spec here:
>
> https://github.com/yoe/nbd/blob/master/doc/proto.md
>
> To ensure that clients always get a suitable error message from the
> NBD server when it is configured with TLS, a client speaking the
> new style protocol will always send NBD_OPT_LIST as the first thing
> it does, so that we can see the NBD_REP_ERR_TLS_REQD response. This
> should all be backwards & forwards compatible with previous QEMU
> impls of NBD
>
> Usage of TLS is described in the commit messages for each patch,
> but for sake of people who don't want to explore the series, here's
> the summary
>
> Starting QEMU system emulator with a disk backed by an TLS encrypted
> NBD export
>
> $ qemu-system-x86_64 \
> -object
> tls-creds-x509,id=tls0,endpoint=client,dir=/home/berrange/security/qemutls \
> -drive driver=nbd,host=localhost,port=9000,tls-creds=tls0
>
> Starting a standalone NBD server providing a TLS encrypted NBD export
>
> $ qemu-nbd \
> --object
> tls-creds-x509,id=tls0,endpoint=server,dir=/home/berrange/security/qemutls
> --tls-creds tls0 \
> --export-name default \
> $IMAGEFILE
>
> The --export-name is optional, if omitted, the default "" will
> be used.
>
> Starting a QEMU system emulator built-in NBD server
>
> $ qemu-system-x86_64 \
> -qmp unix:/tmp/qmp,server \
> -hda /home/berrange/Fedora-Server-netinst-x86_64-23.iso \
> -object
> tls-creds-x509,id=tls0,dir=/home/berrange/security/qemutls,endpoint=server
>
> $ qmp-shell /tmp/qmp
> (qmp) nbd-server-start addr={"host":"localhost","port":"9000"}
> tls-creds=tls0
> (qmp) nbd-server-add device=ide0-hd0
>
> The first 2 patches are taken from this other pending patch
> series in order to facilitate merge:
>
> https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg00296.html
>
> The first 4 patches are the conversion to the I/O channels
> framework.
>
> The next 6 patches are general tweaks to QEMU's impl of the
> NBD protocol for better compliance and/or future proofing.
>
> The next patch provides the NBD protocol TLS implementation.
>
> The final 3 patches allow TLS to be enabled in the QEMU NBD
> client and servers.
>
> Changed in v6:
>
> - Rebase to resolve conflicts with recent qapi changes (Eric)
> and recent nbd changes (Paolo) which merged
> - Add MODULE_INIT_QOM to qemu-io & qemu-img to ensure they
> can load the QIOChannel object types
>
> Changed in v5:
>
> - Pulled in
> https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg00297.html
> and applied fixes for issues Eric mentioned in that review
> - Pulled in
> https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg00302.html
> - Rebased to latest git master
>
> Changed in v4:
>
> - Don't pick the first export name in the list if no export
> name is provided (Paolo)
> - Set client requested export name to "" if none is provided
> by the user (Paolo)
> - Set server advertized export name to "" if TLS is enabled
> and none is provided by the user (Paolo)
> - Rename qemu-nbd --exportname to --export-name (Paolo)
> - Use iov_discard_front() to simplify iov handling (Paolo)
>
> Changed in v3:
>
> - Rebase to resolve conflicts with recently merged NBD patches
>
> Changed in v2:
>
> - Fix error codes used during NBD TLS option negotiate
> - Update patch with helpers for UserCreatable object types
>
> Daniel P. Berrange (16):
> qom: add helpers for UserCreatable object types
> qemu-nbd: add support for --object command line arg
> nbd: convert block client to use I/O channels for connection setup
> nbd: convert qemu-nbd server to use I/O channels for connection setup
> nbd: convert blockdev NBD server to use I/O channels for connection
> setup
> nbd: convert to using I/O channels for actual socket I/O
> nbd: invert client logic for negotiating protocol version
> nbd: make server compliant with fixed newstyle spec
> nbd: make client request fixed new style if advertized
> nbd: allow setting of an export name for qemu-nbd server
> nbd: always query export list in fixed new style protocol
> nbd: use "" as a default export name if none provided
> nbd: implement TLS support in the protocol negotiation
> nbd: enable use of TLS with NBD block driver
> nbd: enable use of TLS with qemu-nbd server
> nbd: enable use of TLS with nbd-server-start command
>
> Makefile | 6 +-
> block/nbd-client.c | 91 ++++++---
> block/nbd-client.h | 10 +-
> block/nbd.c | 105 ++++++++--
> blockdev-nbd.c | 131 ++++++++++--
> hmp.c | 54 ++---
> include/block/nbd.h | 28 ++-
> include/monitor/monitor.h | 3 -
> include/qom/object_interfaces.h | 92 +++++++++
> nbd/client.c | 440
> +++++++++++++++++++++++++++++++++++-----
> nbd/common.c | 83 +++++---
> nbd/nbd-internal.h | 32 ++-
> nbd/server.c | 334 +++++++++++++++++++++---------
> qapi/block.json | 4 +-
> qemu-img.c | 1 +
> qemu-io.c | 1 +
> qemu-nbd.c | 195 ++++++++++++++----
> qemu-nbd.texi | 13 ++
> qmp-commands.hx | 2 +-
> qmp.c | 76 +------
> qom/object_interfaces.c | 174 ++++++++++++++++
> tests/Makefile | 2 +-
> tests/qemu-iotests/140.out | 2 +-
> tests/qemu-iotests/143.out | 2 +-
> vl.c | 68 +------
> 25 files changed, 1459 insertions(+), 490 deletions(-)
>
Queued, thanks.
Paolo
- [Qemu-block] [PATCH v6 11/16] nbd: always query export list in fixed new style protocol, (continued)
- [Qemu-block] [PATCH v6 11/16] nbd: always query export list in fixed new style protocol, Daniel P. Berrange, 2016/02/10
- [Qemu-block] [PATCH v6 12/16] nbd: use "" as a default export name if none provided, Daniel P. Berrange, 2016/02/10
- [Qemu-block] [PATCH v6 14/16] nbd: enable use of TLS with NBD block driver, Daniel P. Berrange, 2016/02/10
- [Qemu-block] [PATCH v6 15/16] nbd: enable use of TLS with qemu-nbd server, Daniel P. Berrange, 2016/02/10
- [Qemu-block] [PATCH v6 13/16] nbd: implement TLS support in the protocol negotiation, Daniel P. Berrange, 2016/02/10
- [Qemu-block] [PATCH v6 16/16] nbd: enable use of TLS with nbd-server-start command, Daniel P. Berrange, 2016/02/10
- Re: [Qemu-block] [Qemu-devel] [PATCH v6 00/16] Implement TLS support to QEMU NBD server & client, Kashyap Chamarthy, 2016/02/12
- Re: [Qemu-block] [PATCH v6 00/16] Implement TLS support to QEMU NBD server & client,
Paolo Bonzini <=