From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35138) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aB33p-00052t-BU for qemu-devel@nongnu.org; Mon, 21 Dec 2015 11:11:46 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aB33l-0000JD-Jo for qemu-devel@nongnu.org; Mon, 21 Dec 2015 11:11:45 -0500 Received: from mx1.redhat.com ([209.132.183.28]:34212) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aB33l-0000J8-EV for qemu-devel@nongnu.org; Mon, 21 Dec 2015 11:11:41 -0500 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (Postfix) with ESMTPS id 228B9263C for ; Mon, 21 Dec 2015 16:11:41 +0000 (UTC) Date: Mon, 21 Dec 2015 16:11:37 +0000 From: "Daniel P. Berrange" Message-ID: <20151221161137.GE5316@redhat.com> References: <1450712543-11629-1-git-send-email-berrange@redhat.com> <1450712543-11629-5-git-send-email-berrange@redhat.com> <567822A0.3020504@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <567822A0.3020504@redhat.com> Subject: Re: [Qemu-devel] [PATCH v2 4/4] char: introduce support for TLS encrypted TCP chardev backend Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini Cc: qemu-devel@nongnu.org On Mon, Dec 21, 2015 at 05:02:40PM +0100, Paolo Bonzini wrote: > > > On 21/12/2015 16:42, Daniel P. Berrange wrote: > > This integrates support for QIOChannelTLS object in the TCP > > chardev backend. If the 'tls-creds=NAME' option is passed with > > the '-chardev tcp' argument, then it will setup the chardev > > such that the client is required to establish a TLS handshake > > when connecting. There is no support for checking the client > > certificate against ACLs in this initial patch. This is pending > > work to QOM-ify the ACL object code. > > Are you also planning AF_UNIX support or does it make no sense? I wasn't planning on it as I don't think it adds any real value. AF_UNIX sockets are trivially secure since they're purely local. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|