Commit b25e12da authored by Daniel P. Berrangé's avatar Daniel P. Berrangé Committed by Eric Blake
Browse files

qemu-nbd: add support for authorization of TLS clients 



Currently any client which can complete the TLS handshake is able to use
the NBD server. The server admin can turn on the 'verify-peer' option
for the x509 creds to require the client to provide a x509 certificate.
This means the client will have to acquire a certificate from the CA
before they are permitted to use the NBD server. This is still a fairly
low bar to cross.

This adds a '--tls-authz OBJECT-ID' option to the qemu-nbd command which
takes the ID of a previously added 'QAuthZ' object instance. This will
be used to validate the client's x509 distinguished name. Clients
failing the authorization check will not be permitted to use the NBD
server.

For example to setup authorization that only allows connection from a client
whose x509 certificate distinguished name is

   CN=laptop.example.com,O=Example Org,L=London,ST=London,C=GB

escape the commas in the name and use:

  qemu-nbd --object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
                    endpoint=server,verify-peer=yes \
           --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\
                     O=Example Org,,L=London,,ST=London,,C=GB' \
           --tls-creds tls0 \
           --tls-authz authz0 \
	   ....other qemu-nbd args...

NB: a real shell command line would not have leading whitespace after
the line continuation, it is just included here for clarity.

Reviewed-by: default avatarJuan Quintela <quintela@redhat.com>
Signed-off-by: default avatarDaniel P. Berrange <berrange@redhat.com>
Message-Id: <20190227162035.18543-2-berrange@redhat.com>
Reviewed-by: default avatarEric Blake <eblake@redhat.com>
[eblake: split long line in --help text, tweak 233 to show that whitespace
after ,, in identity= portion is actually okay]
Signed-off-by: default avatarEric Blake <eblake@redhat.com>
parent c557a8c7

include/block/nbd.h

+1 −1
Original line number Diff line number Diff line
@@ -326,7 +326,7 @@ void nbd_export_close_all(void); 


void nbd_client_new(QIOChannelSocket *sioc,

                    QCryptoTLSCreds *tlscreds,

                    const char *tlsaclname,

                    const char *tlsauthz,

                    void (*close_fn)(NBDClient *, bool));

void nbd_client_get(NBDClient *client);

void nbd_client_put(NBDClient *client);

nbd/server.c

+5 −5
Original line number Diff line number Diff line
@@ -111,7 +111,7 @@ struct NBDClient { 


    NBDExport *exp;

    QCryptoTLSCreds *tlscreds;

    char *tlsaclname;

    char *tlsauthz;

    QIOChannelSocket *sioc; /* The underlying data channel */

    QIOChannel *ioc; /* The current I/O channel which may differ (eg TLS) */
@@ -686,7 +686,7 @@ static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client, 


    tioc = qio_channel_tls_new_server(ioc,

                                      client->tlscreds,

                                      client->tlsaclname,

                                      client->tlsauthz,

                                      errp);

    if (!tioc) {

        return NULL;
@@ -1348,7 +1348,7 @@ void nbd_client_put(NBDClient *client) 
        if (client->tlscreds) {

            object_unref(OBJECT(client->tlscreds));

        }

        g_free(client->tlsaclname);

        g_free(client->tlsauthz);

        if (client->exp) {

            QTAILQ_REMOVE(&client->exp->clients, client, next);

            nbd_export_put(client->exp);
@@ -2425,7 +2425,7 @@ static coroutine_fn void nbd_co_client_start(void *opaque) 
 */

void nbd_client_new(QIOChannelSocket *sioc,

                    QCryptoTLSCreds *tlscreds,

                    const char *tlsaclname,

                    const char *tlsauthz,

                    void (*close_fn)(NBDClient *, bool))

{

    NBDClient *client;
@@ -2437,7 +2437,7 @@ void nbd_client_new(QIOChannelSocket *sioc, 
    if (tlscreds) {

        object_ref(OBJECT(client->tlscreds));

    }

    client->tlsaclname = g_strdup(tlsaclname);

    client->tlsauthz = g_strdup(tlsauthz);

    client->sioc = sioc;

    object_ref(OBJECT(client->sioc));

    client->ioc = QIO_CHANNEL(sioc);

qemu-nbd.c

+18 −1
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ 
#define QEMU_NBD_OPT_TLSCREDS      261

#define QEMU_NBD_OPT_IMAGE_OPTS    262

#define QEMU_NBD_OPT_FORK          263

#define QEMU_NBD_OPT_TLSAUTHZ      264



#define MBR_SIZE 512
@@ -71,6 +72,7 @@ static int shared = 1; 
static int nb_fds;

static QIONetListener *server;

static QCryptoTLSCreds *tlscreds;

static const char *tlsauthz;



static void usage(const char *name)

{
@@ -103,6 +105,8 @@ static void usage(const char *name) 
"  --object type,id=ID,...   define an object such as 'secret' for providing\n"

"                            passwords and/or encryption keys\n"

"  --tls-creds=ID            use id of an earlier --object to provide TLS\n"

"  --tls-authz=ID            use id of an earlier --object to provide\n"

"                            authorization\n"

"  -T, --trace [[enable=]<pattern>][,events=<file>][,file=<file>]\n"

"                            specify tracing options\n"

"  --fork                    fork off the server process and exit the parent\n"
@@ -452,7 +456,7 @@ static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc, 


    nb_fds++;

    nbd_update_server_watch();

    nbd_client_new(cioc, tlscreds, NULL, nbd_client_closed);

    nbd_client_new(cioc, tlscreds, tlsauthz, nbd_client_closed);

}



static void nbd_update_server_watch(void)
@@ -643,6 +647,7 @@ int main(int argc, char **argv) 
        { "export-name", required_argument, NULL, 'x' },

        { "description", required_argument, NULL, 'D' },

        { "tls-creds", required_argument, NULL, QEMU_NBD_OPT_TLSCREDS },

        { "tls-authz", required_argument, NULL, QEMU_NBD_OPT_TLSAUTHZ },

        { "image-opts", no_argument, NULL, QEMU_NBD_OPT_IMAGE_OPTS },

        { "trace", required_argument, NULL, 'T' },

        { "fork", no_argument, NULL, QEMU_NBD_OPT_FORK },
@@ -862,6 +867,9 @@ int main(int argc, char **argv) 
            g_free(trace_file);

            trace_file = trace_opt_parse(optarg);

            break;

        case QEMU_NBD_OPT_TLSAUTHZ:

            tlsauthz = optarg;

            break;

        case QEMU_NBD_OPT_FORK:

            fork_process = true;

            break;
@@ -934,12 +942,21 @@ int main(int argc, char **argv) 
            error_report("TLS is not supported with a host device");

            exit(EXIT_FAILURE);

        }

        if (tlsauthz && list) {

            error_report("TLS authorization is incompatible with export list");

            exit(EXIT_FAILURE);

        }

        tlscreds = nbd_get_tls_creds(tlscredsid, list, &local_err);

        if (local_err) {

            error_report("Failed to get TLS creds %s",

                         error_get_pretty(local_err));

            exit(EXIT_FAILURE);

        }

    } else {

        if (tlsauthz) {

            error_report("--tls-authz is not permitted without --tls-creds");

            exit(EXIT_FAILURE);

        }

    }



    if (list) {

qemu-nbd.texi

+9 −2
Original line number Diff line number Diff line
@@ -117,6 +117,10 @@ option; or provide the credentials needed for connecting as a client 
in list mode.

@item --fork

Fork off the server process and exit the parent once the server is running.

@item --tls-authz=ID

Specify the ID of a qauthz object previously created with the

--object option. This will be used to authorize connecting users

against their x509 distinguished name.

@item -v, --verbose

Display extra debugging information.

@item -h, --help
@@ -142,13 +146,16 @@ qemu-nbd -f qcow2 file.qcow2 
@end example



Start a long-running server listening with encryption on port 10810,

and require clients to have a correct X.509 certificate to connect to

and whitelist clients with a specific X.509 certificate to connect to

a 1 megabyte subset of a raw file, using the export name 'subset':



@example

qemu-nbd \

  --object tls-creds-x509,id=tls0,endpoint=server,dir=/path/to/qemutls \

  --tls-creds tls0 -t -x subset -p 10810 \

  --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\

            O=Example Org,,L=London,,ST=London,,C=GB' \

  --tls-creds tls0 --tls-authz auth0 \

  -t -x subset -p 10810 \

  --image-opts driver=raw,offset=1M,size=1M,file.driver=file,file.filename=file.raw

@end example

tests/qemu-iotests/233

+29 −3
Original line number Diff line number Diff line
@@ -61,6 +61,7 @@ tls_x509_create_root_ca "ca2" 
tls_x509_create_server "ca1" "server1"

tls_x509_create_client "ca1" "client1"

tls_x509_create_client "ca2" "client2"

tls_x509_create_client "ca1" "client3"



echo

echo "== preparing image =="
@@ -93,11 +94,15 @@ $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port 


echo

echo "== check TLS works =="

obj=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0

$QEMU_IMG info --image-opts --object $obj \

obj1=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0

obj2=tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0

$QEMU_IMG info --image-opts --object $obj1 \

    driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \

    2>&1 | sed "s/$nbd_tcp_port/PORT/g"

$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \

$QEMU_IMG info --image-opts --object $obj2 \

    driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \

    2>&1 | sed "s/$nbd_tcp_port/PORT/g"

$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \

    --tls-creds=tls0



echo
@@ -119,6 +124,27 @@ $QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \ 


$QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io



echo

echo "== check TLS with authorization =="



nbd_server_stop



nbd_server_start_tcp_socket \

    --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=yes \

    --object "authz-simple,id=authz0,identity=CN=localhost,, \

      O=Cthulu Dark Lord Enterprises client1,,L=R'lyeh,,C=South Pacific" \

    --tls-authz authz0 \

    --tls-creds tls0 \

    -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"



$QEMU_IMG info --image-opts \

    --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \

    driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0



$QEMU_IMG info --image-opts \

    --object tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0 \

    driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0



echo

echo "== final server log =="

cat "$TEST_DIR/server.log"