[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 05/12] block/nbd: don't restrict TLS usage to IP sockets
From: |
Eric Blake |
Subject: |
Re: [PATCH 05/12] block/nbd: don't restrict TLS usage to IP sockets |
Date: |
Fri, 4 Mar 2022 09:54:04 -0600 |
User-agent: |
NeoMutt/20211029-378-f757a4 |
On Thu, Mar 03, 2022 at 04:03:23PM +0000, Daniel P. Berrangé wrote:
> The TLS usage for NBD was restricted to IP sockets because validating
> x509 certificates requires knowledge of the hostname that the client
> is connecting to.
>
> TLS does not have to use x509 certificates though, as PSK (pre-shared
> keys) provide an alternative credential option. These have no
> requirement for a hostname and can thus be trivially used for UNIX
> sockets.
>
> Furthermore, with the ability to overide the default hostname for
> TLS validation in the previous patch, it is now also valid to want
> to use x509 certificates with FD passing and UNIX sockets.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
> block/nbd.c | 8 ++------
> blockdev-nbd.c | 6 ------
> qemu-nbd.c | 8 +++-----
> 3 files changed, 5 insertions(+), 17 deletions(-)
Reviewed-by: Eric Blake <eblake@redhat.com>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
- [PATCH 01/12] crypto: mandate a hostname when checking x509 creds on a client, (continued)
- [PATCH 01/12] crypto: mandate a hostname when checking x509 creds on a client, Daniel P . Berrangé, 2022/03/03
- [PATCH 02/12] block: pass desired TLS hostname through from block driver client, Daniel P . Berrangé, 2022/03/03
- [PATCH 03/12] block/nbd: support override of hostname for TLS certificate validation, Daniel P . Berrangé, 2022/03/03
- [PATCH 04/12] qemu-nbd: add --tls-hostname option for TLS certificate validation, Daniel P . Berrangé, 2022/03/03
- [PATCH 05/12] block/nbd: don't restrict TLS usage to IP sockets, Daniel P . Berrangé, 2022/03/03
- Re: [PATCH 05/12] block/nbd: don't restrict TLS usage to IP sockets,
Eric Blake <=
- [PATCH 06/12] tests/qemu-iotests: add QEMU_IOTESTS_REGEN=1 to update reference file, Daniel P . Berrangé, 2022/03/03
- [PATCH 08/12] tests/qemu-iotests: introduce filter for qemu-nbd export list, Daniel P . Berrangé, 2022/03/03
- [PATCH 07/12] tests/qemu-iotests: expand _filter_nbd rules, Daniel P . Berrangé, 2022/03/03
- [PATCH 09/12] tests/qemu-iotests: convert NBD TLS test to use standard filters, Daniel P . Berrangé, 2022/03/03
- [PATCH 11/12] tests/qemu-iotests: validate NBD TLS with UNIX sockets, Daniel P . Berrangé, 2022/03/03