From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54806) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zz8uB-0005Bs-M3 for qemu-devel@nongnu.org; Wed, 18 Nov 2015 15:00:36 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Zz8u8-0004E3-CI for qemu-devel@nongnu.org; Wed, 18 Nov 2015 15:00:35 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50971) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zz8u8-0004Dq-3l for qemu-devel@nongnu.org; Wed, 18 Nov 2015 15:00:32 -0500 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id 1A8E3A286B for ; Wed, 18 Nov 2015 20:00:31 +0000 (UTC) References: <1447872538-1713-1-git-send-email-berrange@redhat.com> <1447872538-1713-5-git-send-email-berrange@redhat.com> From: Eric Blake Message-ID: <564CD8D9.2090104@redhat.com> Date: Wed, 18 Nov 2015 13:00:25 -0700 MIME-Version: 1.0 In-Reply-To: <1447872538-1713-5-git-send-email-berrange@redhat.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="n68IOxlT8HXJDowcGjBrmJDJQ7QxBT2sq" Subject: Re: [Qemu-devel] [PATCH v1 4/4] char: introduce support for TLS encrypted TCP chardev backend List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" , qemu-devel@nongnu.org Cc: Paolo Bonzini This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --n68IOxlT8HXJDowcGjBrmJDJQ7QxBT2sq Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 11/18/2015 11:48 AM, Daniel P. Berrange wrote: > This integrates support for QIOChannelTLS object in the TCP > chardev backend. If the 'tls-creds=3DNAME' option is passed with > the '-chardev tcp' argument, then it will setup the chardev > such that the client is required to establish a TLS handshake > when connecting. There is no support for checking the client > certificate against ACLs in this initial patch. This is pending > work to QOM-ify the ACL object code. >=20 > A complete invocation to run QEMU as the server for a TLS > encrypted serial dev might be >=20 > $ qemu-system-x86_64 \ > -nodefconfig -nodefaults -device sga -display none \ > -chardev socket,id=3Ds0,host=3D127.0.0.1,port=3D9000,tls-creds=3D= tls0,server \ > -device isa-serial,chardev=3Ds0 \ > -object tls-creds-x509,id=3Dtls0,endpoint=3Dserver,verify-peer=3D= off,\ > dir=3D/home/berrange/security/qemutls >=20 > To test with the gnutls-cli tool as the client: >=20 > $ gnutls-cli --priority=3DNORMAL -p 9000 \ > --x509cafile=3D/home/berrange/security/qemutls/ca-cert.pem \ > 127.0.0.1 >=20 > If QEMU was told to use 'anon' credential type, then use the > priority string 'NORMAL:+ANON-DH' with gnutls-cli >=20 > Alternatively, if setting up a chardev to operate as a client, > then the TLS credentials registered must be for the client > endpoint. First a TLS server must be setup, which can be done > with the gnutls-serv tool >=20 > $ gnutls-serv --priority=3DNORMAL -p 9000 --echo \ > --x509cafile=3D/home/berrange/security/qemutls/ca-cert.pem \ > --x509certfile=3D/home/berrange/security/qemutls/server-cert.pem= \ > --x509keyfile=3D/home/berrange/security/qemutls/server-key.pem >=20 > Then QEMU can connect with >=20 > $ qemu-system-x86_64 \ > -nodefconfig -nodefaults -device sga -display none \ > -chardev socket,id=3Ds0,host=3D127.0.0.1,port=3D9000,tls-creds=3D= tls0 \ > -device isa-serial,chardev=3Ds0 \ > -object tls-creds-x509,id=3Dtls0,endpoint=3Dclient,\ > dir=3D/home/berrange/security/qemutls >=20 > Signed-off-by: Daniel P. Berrange > --- > qapi-schema.json | 2 + > qemu-char.c | 138 +++++++++++++++++++++++++++++++++++++++++++++++= +++----- > qemu-options.hx | 9 +++- > 3 files changed, 135 insertions(+), 14 deletions(-) >=20 > diff --git a/qapi-schema.json b/qapi-schema.json > index 8b1a423..be6636c 100644 > --- a/qapi-schema.json > +++ b/qapi-schema.json > @@ -3046,6 +3046,7 @@ > # > # @addr: socket address to listen on (server=3Dtrue) > # or connect to (server=3Dfalse) > +# @tls-creds: #optional the ID of the TLS credentials object (since 2.= 4) 2.6, now :) --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --n68IOxlT8HXJDowcGjBrmJDJQ7QxBT2sq Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJWTNjZAAoJEKeha0olJ0NqCM0H/0OWpBPEaM38rH3cj6LQz474 TaqH3R3rfiNk1dP9A/RtE8F8fAHZC4NybMTyJA5DTlyn6OGk23n1YKZhR+5ulEhn 6xQ9/v4msDb7l/PCzddFL6Va84DpLWAYJc53NZWvaa8KsjcrjYv6Ot2jrlYAXvOg MJqse0rFB2McDGOZACgIkwm0e0s33Jns2MqdFl2ir5gZog0MEuaceUekOa5XnRAE 6CDB4m62dqoY2QC7I2178wsFv7YO3cWZst1PXVfTYQudxCCCnAmE3wo9vC2kS4+R 8dVs+lqFm06VFMAn1S3qEEsgdKYzmLKu/4H8iD+CVNg6JTXW0oqfyOXVqkDwDCU= =3vu2 -----END PGP SIGNATURE----- --n68IOxlT8HXJDowcGjBrmJDJQ7QxBT2sq--