From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54340) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d86iU-0007NX-Pd for qemu-devel@nongnu.org; Tue, 09 May 2017 11:06:24 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d86iR-00089V-Kv for qemu-devel@nongnu.org; Tue, 09 May 2017 11:06:22 -0400 Date: Tue, 9 May 2017 17:06:05 +0200 From: Kevin Wolf Message-ID: <20170509150605.GG5243@noname.str.redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] [Qemu-block] [PATCH] block: curl: Allow passing cookies via QCryptoSecret List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Krempa Cc: qemu-devel@nongnu.org, berrange@redhat.com, qemu-block@nongnu.org, Max Reitz , jcody@redhat.com Am 04.05.2017 um 16:00 hat Peter Krempa geschrieben: > Since cookies can contain sensitive data (session ID, etc ...) it is > desired to hide them from the prying eyes of users. Add a possibility to > pass them via the secret infrastructure. > > Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1447413 > > Signed-off-by: Peter Krempa I didn't really look at the patch, just adding a maintainer CC: $ scripts/get_maintainer.pl -f block/curl.c Jeff Cody (supporter:CURL) ... Kevin > block/curl.c | 24 +++++++++++++++++++++++- > qapi/block-core.json | 12 ++++++++++-- > 2 files changed, 33 insertions(+), 3 deletions(-) > > diff --git a/block/curl.c b/block/curl.c > index 2708d57c2f..483640b14a 100644 > --- a/block/curl.c > +++ b/block/curl.c > @@ -85,6 +85,7 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle, > #define CURL_BLOCK_OPT_SSLVERIFY "sslverify" > #define CURL_BLOCK_OPT_TIMEOUT "timeout" > #define CURL_BLOCK_OPT_COOKIE "cookie" > +#define CURL_BLOCK_OPT_COOKIE_SECRET "cookie-secret" > #define CURL_BLOCK_OPT_USERNAME "username" > #define CURL_BLOCK_OPT_PASSWORD_SECRET "password-secret" > #define CURL_BLOCK_OPT_PROXY_USERNAME "proxy-username" > @@ -624,6 +625,11 @@ static QemuOptsList runtime_opts = { > .help = "Pass the cookie or list of cookies with each request" > }, > { > + .name = CURL_BLOCK_OPT_COOKIE_SECRET, > + .type = QEMU_OPT_STRING, > + .help = "ID of secret used as cookie passed with each request" > + }, > + { > .name = CURL_BLOCK_OPT_USERNAME, > .type = QEMU_OPT_STRING, > .help = "Username for HTTP auth" > @@ -657,6 +663,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags, > Error *local_err = NULL; > const char *file; > const char *cookie; > + const char *cookie_secret; > double d; > const char *secretid; > const char *protocol_delimiter; > @@ -693,7 +700,22 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags, > s->sslverify = qemu_opt_get_bool(opts, CURL_BLOCK_OPT_SSLVERIFY, true); > > cookie = qemu_opt_get(opts, CURL_BLOCK_OPT_COOKIE); > - s->cookie = g_strdup(cookie); > + cookie_secret = qemu_opt_get(opts, CURL_BLOCK_OPT_COOKIE_SECRET); > + > + if (cookie && cookie_secret) { > + error_setg(errp, > + "curl driver cannot handle both cookie and cookie secret"); > + goto out_noclean; > + } > + > + if (cookie_secret) { > + s->cookie = qcrypto_secret_lookup_as_utf8(cookie_secret, errp); > + if (!s->cookie) { > + goto out_noclean; > + } > + } else { > + s->cookie = g_strdup(cookie); > + } > > file = qemu_opt_get(opts, CURL_BLOCK_OPT_URL); > if (file == NULL) { > diff --git a/qapi/block-core.json b/qapi/block-core.json > index 87fb747ab6..b1643d2032 100644 > --- a/qapi/block-core.json > +++ b/qapi/block-core.json > @@ -2782,11 +2782,15 @@ > # "name1=content1; name2=content2;" as explained by > # CURLOPT_COOKIE(3). Defaults to no cookies. > # > +# @cookie-secret: ID of a QCryptoSecret object providing the cookie data in a > +# secure way. See @cookie for the format. (since 2.10) > +# > # Since: 2.9 > ## > { 'struct': 'BlockdevOptionsCurlHttp', > 'base': 'BlockdevOptionsCurlBase', > - 'data': { '*cookie': 'str' } } > + 'data': { '*cookie': 'str', > + '*cookie-secret': 'str'} } > > ## > # @BlockdevOptionsCurlHttps: > @@ -2801,12 +2805,16 @@ > # @sslverify: Whether to verify the SSL certificate's validity (defaults to > # true) > # > +# @cookie-secret: ID of a QCryptoSecret object providing the cookie data in a > +# secure way. See @cookie for the format. (since 2.10) > +# > # Since: 2.9 > ## > { 'struct': 'BlockdevOptionsCurlHttps', > 'base': 'BlockdevOptionsCurlBase', > 'data': { '*cookie': 'str', > - '*sslverify': 'bool' } } > + '*sslverify': 'bool', > + '*cookie-secret': 'str'} } > > ## > # @BlockdevOptionsCurlFtp: > -- > 2.12.2 > >