Re: [Qemu-devel] [PATCH 2/6] nbd: allow authorization with nbd-server-start QMP command

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Jun 19, 2018 at 03:10:12PM -0500, Eric Blake wrote:
> On 06/15/2018 10:50 AM, Daniel P. Berrangé wrote:
> > From: "Daniel P. Berrange" <berrange@redhat.com>
> > 
> > As with the previous patch to qemu-nbd, the nbd-server-start QMP command
> > also needs to be able to specify authorization when enabling TLS encryption.
> > 
> > First the client must create a QAuthZ object instance using the
> > 'object-add' command:
> > 
> >     {
> >       'execute': 'object-add',
> >       'arguments': {
> >         'qom-type': 'authz-simple',
> >         'id': 'authz0',
> >         'parameters': {
> >           'policy': 'deny',
> >           'rules': [
> >             {
> >               'match': '*CN=fred',
> >               'policy': 'allow'
> >             }
> >           ]
> >         }
> >       }
> >     }
> > 
> > They can then reference this in the new 'tls-authz' parameter when
> > executing the 'nbd-server-start' command:
> > 
> >     {
> >       'execute': 'nbd-server-start',
> >       'arguments': {
> >         'addr': {
> >             'type': 'inet',
> >             'host': '127.0.0.1',
> >             'port': '9000'
> >         },
> >         'tls-creds': 'tls0',
> >         'tls-authz': 'authz0'
> >       }
> >     }
> 
> Is it worth using a discriminated union (string vs. QAuthZ) so that one
> could specify the authz policy inline rather than as a separate object, for
> convenience?  But that would be fine as a followup patch, if we even want
> it.

QAuthZ isn't a QAPI type - its a QOM object interface, so you'd have to
allow the entire object_add arg set inline, and then validate the QOM type
you received after the fact actually implemented the interface.  Also for
migration at least it is likely the single authz impl will be shared for
both migration + nbd services. So I think its cleaner just to keep it
separate to avoid having 2 distinct codepaths for handling the same thing


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|