Re: [Qemu-block] [PATCH] qemu-nbd: Permit TLS with Unix sockets

[Eric Blake]

On 6/26/19 3:22 AM, Daniel P. Berrangé wrote:
> On Tue, Jun 25, 2019 at 09:49:42PM -0500, Eric Blake wrote:
>> Although you generally won't use encryption with a Unix socket (after
>> all, everything is local, so why waste the CPU power), there are
>> situations in testsuites where Unix sockets are much nicer than TCP
>> sockets.  Since nbdkit allows encryption over both types of sockets,
>> it makes sense for qemu-nbd to do likewise.
>>
>> Signed-off-by: Eric Blake <address@hidden>
>> ---
>>  qemu-nbd.c | 4 ----
>>  1 file changed, 4 deletions(-)
> 
> Reviewed-by: Daniel P. Berrangé <address@hidden>
> 
> 
> Do you need something on the client side too ?

The proposal that Rich is working on for standardized NBD URIs [1] says
that we need a patch to support nbds://host/export and
nbds+unix://export?socket=/path as ways to request an encrypted client
connection with default encryption parameters. For anything more
complex, we have to use --imageopts and request an encrypted connection
by parts - but the QAPI schema already permits us to pass in an
'tls-creds' parameter for both TCP and Unix sockets, so no, I don't
think we need any client side changes at this point.

I do, however, plan to test that 'qemu-nbd --list -k socket --tls...'
works (I think it does, and it can be used even without this patch
against nbdkit as server...), prior to taking this patch through my NBD
tree.

[1] https://lists.debian.org/nbd/2019/06/msg00011.html

> 
> 
> Regards,
> Daniel
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

signature.asc
Description: OpenPGP digital signature