Re: [Qemu-devel] [PATCH v2 RFC] qemu-nbd: Permit TLS with Unix sockets

["Daniel P. Berrangé" <berrange@redhat.com>]

On Fri, Jul 05, 2019 at 11:31:51AM +0200, Max Reitz wrote:
> On 04.07.19 00:47, Eric Blake wrote:



> > diff --git a/tests/qemu-iotests/233.out b/tests/qemu-iotests/233.out
> > index 9b46284ab0de..b86bee020649 100644
> > --- a/tests/qemu-iotests/233.out
> > +++ b/tests/qemu-iotests/233.out
> 
> [...]
> 
> > +== check TLS works over Unix ==
> > +image: nbd+unix://?socket=SOCKET
> > +file format: nbd
> > +virtual size: 64 MiB (67108864 bytes)
> > +disk size: unavailable
> 
> This has worked surprisingly well considering you did not pass tls-hostname.
> 
> On the same note: If I remove the tls-hostname option from the “perform
> I/O over TLS” test, it keeps working.

Yeah, that's a bug in crypto/tlssession.c.

It is assuming that the hostname will always be provided for sessions
in client mode, which was valid previously as all sessions were TCP
based. ie it assumed that if hostname was NULL, it was doing server
side certificate validation.

That assumption is bogus now we allow sessions on non-TCP, so we must
fix the code thus:


@@ -365,6 +367,14 @@ qcrypto_tls_session_check_certificate(QCryptoTLSSession *session,
                     goto error;
                 }
             }
+            if (!session->hostname &&
+                session->creds->endpoint ==
+                QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
+                error_setg(errp,
+                           "No hostname available to validate against "
+                           "server's x509 certificate");
+                goto error;
+            }
             if (session->hostname) {
                 if (!gnutls_x509_crt_check_hostname(cert, session->hostname)) {
                     error_setg(errp,



Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|