From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59788) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aiTp7-0001C2-Uv for qemu-devel@nongnu.org; Tue, 22 Mar 2016 17:26:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aiTp6-0006r2-Sm for qemu-devel@nongnu.org; Tue, 22 Mar 2016 17:26:45 -0400 References: <1457635927-23045-1-git-send-email-berrange@redhat.com> <1457636396-24983-1-git-send-email-berrange@redhat.com> <1457636396-24983-9-git-send-email-berrange@redhat.com> From: Eric Blake Message-ID: <56F1B88E.5030205@redhat.com> Date: Tue, 22 Mar 2016 15:26:38 -0600 MIME-Version: 1.0 In-Reply-To: <1457636396-24983-9-git-send-email-berrange@redhat.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="5UWviss0j7k9B231wTitlq0AkE65LucW9" Subject: Re: [Qemu-devel] [PATCH v3 09/10] chardev: add support for ACLs for TLS clients List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" , qemu-devel@nongnu.org Cc: Paolo Bonzini , qemu-block@nongnu.org, Markus Armbruster , =?UTF-8?Q?Andreas_F=c3=a4rber?= , Max Reitz This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --5UWviss0j7k9B231wTitlq0AkE65LucW9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 03/10/2016 11:59 AM, Daniel P. Berrange wrote: > Currently any client which can complete the TLS handshake > is able to use a chardev server. The server admin can turn > on the 'verify-peer' option for the x509 creds to require > the client to provide a x509 certificate. This means the > client will have to acquire a certificate from the CA before > they are permitted to use the chardev server. This is still > a fairly weak bar. >=20 > This adds a 'tls-acl=3DACL-ID' option to the socket chardev > backend which takes the ID of a previously added 'QAuthZ' > object instance. This ACL will be used to validate the client's > x509 distinguished name. Clients failing the ACL will not be > permitted to use the chardev server. >=20 > For example to setup an ACL that only allows connection from > a client whose x509 certificate distinguished name contains > 'CN=3Dfred', you would use: >=20 > $QEMU -object tls-creds-x509,id=3Dtls0,dir=3D/home/berrange/qemutls,\= > endpoint=3Dserver,verify-peer=3Dyes \ > -object authz-simple,id=3Dacl0,policy=3Ddeny,\ > rules.0.match=3D*CN=3Dfred,rules.0.policy=3Dallow \ Needs shell quoting for *, and also the same recurring comment about whitespace for presentation not actually being in the command line. Food for thought: should we enhance QemuOpts to skip all whitespace after ',', since we _know_ that valid key names start with a letter rather than a space? Then, we could represent command lines as: $QEMU -object 'name, param1=3Dvalue, param2=3Dvalue' with the same semantics as: $QEMU -object name,param1=3Dvalue,param2=3Dvalue and without having to worry about backslash-newline-whitespace formatting. Obviously, such an enhancement would be a separate patch. > -chardev socket,host=3D127.0.0.1,port=3D9000,server,\ > tls-creds=3Dtls0,tls-acl=3Dacl0 \ > ...other qemud args... >=20 > Signed-off-by: Daniel P. Berrange > --- > qapi-schema.json | 2 ++ > qemu-char.c | 11 ++++++++++- > 2 files changed, 12 insertions(+), 1 deletion(-) >=20 Code is fine; my only comments were on the commit message. Reviewed-by: Eric Blake --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --5UWviss0j7k9B231wTitlq0AkE65LucW9 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJW8biOAAoJEKeha0olJ0NqUqAH/2vvcKjauriS5oaqxw4/a+pI bIHhaJjCCfcQsd+lI9mFJxqRz851r3nPhlqD3x2sbP2HY/p+Ck4fd2M6Y7W47Dy9 Vc5vi/Ct4v2TmlY3by7N/PE87wGD5tDL0EFE1952PocDvQTWWRrs8za6nLeCjqbo IuWbg8q6VjQlgob9A9dcszMwcxVvAc410YCc4AdeUZ+7s0d3GKHifawgbcIn9Zox uttX94eL23Rr0UqRJnMxFM1M2fwKQisRSVxeG7XYkPU26Aqc0Q4fzKrEvbYNbX7p 6wKxcs7NKLqDCa+70gUBZ3q43wbNUrusAxHsr9UEi8p6Mm6XAKE4dvdETqxajgI= =vsAg -----END PGP SIGNATURE----- --5UWviss0j7k9B231wTitlq0AkE65LucW9--