Commit e2a18635 authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2019-03-08' into staging 



nbd patches for 2019-03-08

- support TLS client authorization in NBD servers
- iotest 223 race fix

# gpg: Signature made Fri 08 Mar 2019 17:37:59 GMT
# gpg:                using RSA key A7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>" [full]
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" [full]
# gpg:                 aka "[jpeg image of size 6874]" [full]
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A

* remotes/ericb/tags/pull-nbd-2019-03-08:
  iotests: Wait for qemu to end in 223
  nbd: fix outdated qapi docs syntax for tls-creds
  nbd: allow authorization with nbd-server-start QMP command
  qemu-nbd: add support for authorization of TLS clients

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents f5b4c310 054be360

blockdev-nbd.c

+8 −3
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
typedef struct NBDServerData {

    QIONetListener *listener;

    QCryptoTLSCreds *tlscreds;

    char *tlsauthz;

} NBDServerData;



static NBDServerData *nbd_server;
@@ -36,7 +37,7 @@ static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc, 
                       gpointer opaque)

{

    qio_channel_set_name(QIO_CHANNEL(cioc), "nbd-server");

    nbd_client_new(cioc, nbd_server->tlscreds, NULL,

    nbd_client_new(cioc, nbd_server->tlscreds, nbd_server->tlsauthz,

                   nbd_blockdev_client_closed);

}
@@ -52,6 +53,7 @@ static void nbd_server_free(NBDServerData *server) 
    if (server->tlscreds) {

        object_unref(OBJECT(server->tlscreds));

    }

    g_free(server->tlsauthz);



    g_free(server);

}
@@ -87,7 +89,7 @@ static QCryptoTLSCreds *nbd_get_tls_creds(const char *id, Error **errp) 




void nbd_server_start(SocketAddress *addr, const char *tls_creds,

                      Error **errp)

                      const char *tls_authz, Error **errp)

{

    if (nbd_server) {

        error_setg(errp, "NBD server already running");
@@ -117,6 +119,8 @@ void nbd_server_start(SocketAddress *addr, const char *tls_creds, 
        }

    }



    nbd_server->tlsauthz = g_strdup(tls_authz);



    qio_net_listener_set_client_func(nbd_server->listener,

                                     nbd_accept,

                                     NULL,
@@ -131,11 +135,12 @@ void nbd_server_start(SocketAddress *addr, const char *tls_creds, 


void qmp_nbd_server_start(SocketAddressLegacy *addr,

                          bool has_tls_creds, const char *tls_creds,

                          bool has_tls_authz, const char *tls_authz,

                          Error **errp)

{

    SocketAddress *addr_flat = socket_address_flatten(addr);



    nbd_server_start(addr_flat, tls_creds, errp);

    nbd_server_start(addr_flat, tls_creds, tls_authz, errp);

    qapi_free_SocketAddress(addr_flat);

}

hmp.c

+1 −1
Original line number Diff line number Diff line
@@ -2373,7 +2373,7 @@ void hmp_nbd_server_start(Monitor *mon, const QDict *qdict) 
        goto exit;

    }



    nbd_server_start(addr, NULL, &local_err);

    nbd_server_start(addr, NULL, NULL, &local_err);

    qapi_free_SocketAddress(addr);

    if (local_err != NULL) {

        goto exit;

include/block/nbd.h

+2 −2
Original line number Diff line number Diff line
@@ -326,13 +326,13 @@ void nbd_export_close_all(void); 


void nbd_client_new(QIOChannelSocket *sioc,

                    QCryptoTLSCreds *tlscreds,

                    const char *tlsaclname,

                    const char *tlsauthz,

                    void (*close_fn)(NBDClient *, bool));

void nbd_client_get(NBDClient *client);

void nbd_client_put(NBDClient *client);



void nbd_server_start(SocketAddress *addr, const char *tls_creds,

                      Error **errp);

                      const char *tls_authz, Error **errp);



/* nbd_read

 * Reads @size bytes from @ioc. Returns 0 on success.

nbd/server.c

+5 −5
Original line number Diff line number Diff line
@@ -111,7 +111,7 @@ struct NBDClient { 


    NBDExport *exp;

    QCryptoTLSCreds *tlscreds;

    char *tlsaclname;

    char *tlsauthz;

    QIOChannelSocket *sioc; /* The underlying data channel */

    QIOChannel *ioc; /* The current I/O channel which may differ (eg TLS) */
@@ -686,7 +686,7 @@ static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client, 


    tioc = qio_channel_tls_new_server(ioc,

                                      client->tlscreds,

                                      client->tlsaclname,

                                      client->tlsauthz,

                                      errp);

    if (!tioc) {

        return NULL;
@@ -1348,7 +1348,7 @@ void nbd_client_put(NBDClient *client) 
        if (client->tlscreds) {

            object_unref(OBJECT(client->tlscreds));

        }

        g_free(client->tlsaclname);

        g_free(client->tlsauthz);

        if (client->exp) {

            QTAILQ_REMOVE(&client->exp->clients, client, next);

            nbd_export_put(client->exp);
@@ -2425,7 +2425,7 @@ static coroutine_fn void nbd_co_client_start(void *opaque) 
 */

void nbd_client_new(QIOChannelSocket *sioc,

                    QCryptoTLSCreds *tlscreds,

                    const char *tlsaclname,

                    const char *tlsauthz,

                    void (*close_fn)(NBDClient *, bool))

{

    NBDClient *client;
@@ -2437,7 +2437,7 @@ void nbd_client_new(QIOChannelSocket *sioc, 
    if (tlscreds) {

        object_ref(OBJECT(client->tlscreds));

    }

    client->tlsaclname = g_strdup(tlsaclname);

    client->tlsauthz = g_strdup(tlsauthz);

    client->sioc = sioc;

    object_ref(OBJECT(client->sioc));

    client->ioc = QIO_CHANNEL(sioc);

qapi/block.json

+8 −2
Original line number Diff line number Diff line
@@ -224,7 +224,12 @@ 
# QEMU instance could refer to them as "nbd:HOST:PORT:exportname=NAME".

#

# @addr: Address on which to listen.

# @tls-creds: (optional) ID of the TLS credentials object. Since 2.6

# @tls-creds: ID of the TLS credentials object (since 2.6).

# @tls-authz: ID of the QAuthZ authorization object used to validate

#             the client's x509 distinguished name. This object is

#             is only resolved at time of use, so can be deleted and

#             recreated on the fly while the NBD server is active.

#             If missing, it will default to denying access (since 4.0).

#

# Returns: error if the server is already running.

#
@@ -232,7 +237,8 @@ 
##

{ 'command': 'nbd-server-start',

  'data': { 'addr': 'SocketAddressLegacy',

            '*tls-creds': 'str'} }

            '*tls-creds': 'str',

            '*tls-authz': 'str'} }



##

# @nbd-server-add: