Re: [Qemu-devel] [PATCH v1 4/4] char: introduce support for TLS encrypted TCP chardev backend

[Eric Blake <eblake@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2819 bytes --]

On 11/18/2015 11:48 AM, Daniel P. Berrange wrote:
> This integrates support for QIOChannelTLS object in the TCP
> chardev backend. If the 'tls-creds=NAME' option is passed with
> the '-chardev tcp' argument, then it will setup the chardev
> such that the client is required to establish a TLS handshake
> when connecting. There is no support for checking the client
> certificate against ACLs in this initial patch. This is pending
> work to QOM-ify the ACL object code.
> 
> A complete invocation to run QEMU as the server for a TLS
> encrypted serial dev might be
> 
>   $ qemu-system-x86_64 \
>       -nodefconfig -nodefaults -device sga -display none \
>       -chardev socket,id=s0,host=127.0.0.1,port=9000,tls-creds=tls0,server \
>       -device isa-serial,chardev=s0 \
>       -object tls-creds-x509,id=tls0,endpoint=server,verify-peer=off,\
>          dir=/home/berrange/security/qemutls
> 
> To test with the gnutls-cli tool as the client:
> 
>   $ gnutls-cli --priority=NORMAL -p 9000 \
>        --x509cafile=/home/berrange/security/qemutls/ca-cert.pem \
>        127.0.0.1
> 
> If QEMU was told to use 'anon' credential type, then use the
> priority string 'NORMAL:+ANON-DH' with gnutls-cli
> 
> Alternatively, if setting up a chardev to operate as a client,
> then the TLS credentials registered must be for the client
> endpoint. First a TLS server must be setup, which can be done
> with the gnutls-serv tool
> 
>   $ gnutls-serv --priority=NORMAL -p 9000 --echo \
>        --x509cafile=/home/berrange/security/qemutls/ca-cert.pem \
>        --x509certfile=/home/berrange/security/qemutls/server-cert.pem \
>        --x509keyfile=/home/berrange/security/qemutls/server-key.pem
> 
> Then QEMU can connect with
> 
>   $ qemu-system-x86_64 \
>       -nodefconfig -nodefaults -device sga -display none \
>       -chardev socket,id=s0,host=127.0.0.1,port=9000,tls-creds=tls0 \
>       -device isa-serial,chardev=s0 \
>       -object tls-creds-x509,id=tls0,endpoint=client,\
>         dir=/home/berrange/security/qemutls
> 
> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> ---
>  qapi-schema.json |   2 +
>  qemu-char.c      | 138 ++++++++++++++++++++++++++++++++++++++++++++++++++-----
>  qemu-options.hx  |   9 +++-
>  3 files changed, 135 insertions(+), 14 deletions(-)
> 
> diff --git a/qapi-schema.json b/qapi-schema.json
> index 8b1a423..be6636c 100644
> --- a/qapi-schema.json
> +++ b/qapi-schema.json
> @@ -3046,6 +3046,7 @@
>  #
>  # @addr: socket address to listen on (server=true)
>  #        or connect to (server=false)
> +# @tls-creds: #optional the ID of the TLS credentials object (since 2.4)

2.6, now :)


-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 604 bytes --]