145614a112
This modifies the qemu-nbd program so that it is possible to
request the use of TLS with the server. It simply adds a new
command line option --tls-creds which is used to provide the
ID of a QCryptoTLSCreds object previously created via the
--object command line option.
For example
qemu-nbd --object tls-creds-x509,id=tls0,endpoint=server,\
dir=/home/berrange/security/qemutls \
--tls-creds tls0 \
--exportname default
TLS requires the new style NBD protocol, so if no export name
is set (via --export-name), then we use the default NBD protocol
export name ""
TLS is only supported when using an IPv4/IPv6 socket listener.
It is not possible to use with UNIX sockets, which includes
when connecting the NBD server to a host device.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1455129674-17255-16-git-send-email-berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
110 lines
3.7 KiB
Plaintext
110 lines
3.7 KiB
Plaintext
@example
|
|
@c man begin SYNOPSIS
|
|
@command{qemu-nbd} [OPTION]... @var{filename}
|
|
|
|
@command{qemu-nbd} @option{-d} @var{dev}
|
|
@c man end
|
|
@end example
|
|
|
|
@c man begin DESCRIPTION
|
|
|
|
Export a QEMU disk image using the NBD protocol.
|
|
|
|
@c man end
|
|
|
|
@c man begin OPTIONS
|
|
@var{filename} is a disk image filename.
|
|
|
|
@var{dev} is an NBD device.
|
|
|
|
@table @option
|
|
@item --object type,id=@var{id},...props...
|
|
Define a new instance of the @var{type} object class identified by @var{id}.
|
|
See the @code{qemu(1)} manual page for full details of the properties
|
|
supported. The common object types that it makes sense to define are the
|
|
@code{secret} object, which is used to supply passwords and/or encryption
|
|
keys, and the @code{tls-creds} object, which is used to supply TLS
|
|
credentials for the qemu-nbd server.
|
|
@item -p, --port=@var{port}
|
|
The TCP port to listen on (default @samp{10809})
|
|
@item -o, --offset=@var{offset}
|
|
The offset into the image
|
|
@item -b, --bind=@var{iface}
|
|
The interface to bind to (default @samp{0.0.0.0})
|
|
@item -k, --socket=@var{path}
|
|
Use a unix socket with path @var{path}
|
|
@item -f, --format=@var{fmt}
|
|
Force the use of the block driver for format @var{fmt} instead of
|
|
auto-detecting
|
|
@item -r, --read-only
|
|
Export the disk as read-only
|
|
@item -P, --partition=@var{num}
|
|
Only expose partition @var{num}
|
|
@item -s, --snapshot
|
|
Use @var{filename} as an external snapshot, create a temporary
|
|
file with backing_file=@var{filename}, redirect the write to
|
|
the temporary one
|
|
@item -l, --load-snapshot=@var{snapshot_param}
|
|
Load an internal snapshot inside @var{filename} and export it
|
|
as an read-only device, @var{snapshot_param} format is
|
|
'snapshot.id=[ID],snapshot.name=[NAME]' or '[ID_OR_NAME]'
|
|
@item -n, --nocache
|
|
@itemx --cache=@var{cache}
|
|
The cache mode to be used with the file. See the documentation of
|
|
the emulator's @code{-drive cache=...} option for allowed values.
|
|
@item --aio=@var{aio}
|
|
Set the asynchronous I/O mode between @samp{threads} (the default)
|
|
and @samp{native} (Linux only).
|
|
@item --discard=@var{discard}
|
|
Control whether @dfn{discard} (also known as @dfn{trim} or @dfn{unmap})
|
|
requests are ignored or passed to the filesystem. @var{discard} is one of
|
|
@samp{ignore} (or @samp{off}), @samp{unmap} (or @samp{on}). The default is
|
|
@samp{ignore}.
|
|
@item --detect-zeroes=@var{detect-zeroes}
|
|
Control the automatic conversion of plain zero writes by the OS to
|
|
driver-specific optimized zero write commands. @var{detect-zeroes} is one of
|
|
@samp{off}, @samp{on} or @samp{unmap}. @samp{unmap}
|
|
converts a zero write to an unmap operation and can only be used if
|
|
@var{discard} is set to @samp{unmap}. The default is @samp{off}.
|
|
@item -c, --connect=@var{dev}
|
|
Connect @var{filename} to NBD device @var{dev}
|
|
@item -d, --disconnect
|
|
Disconnect the device @var{dev}
|
|
@item -e, --shared=@var{num}
|
|
Allow up to @var{num} clients to share the device (default @samp{1})
|
|
@item -t, --persistent
|
|
Don't exit on the last connection
|
|
@item -x NAME, --export-name=NAME
|
|
Set the NBD volume export name. This switches the server to use
|
|
the new style NBD protocol negotiation
|
|
@item --tls-creds=ID
|
|
Enable mandatory TLS encryption for the server by setting the ID
|
|
of the TLS credentials object previously created with the --object
|
|
option.
|
|
@item -v, --verbose
|
|
Display extra debugging information
|
|
@item -h, --help
|
|
Display this help and exit
|
|
@item -V, --version
|
|
Display version information and exit
|
|
@end table
|
|
|
|
@c man end
|
|
|
|
@ignore
|
|
|
|
@setfilename qemu-nbd
|
|
@settitle QEMU Disk Network Block Device Server
|
|
|
|
@c man begin AUTHOR
|
|
Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>.
|
|
This is free software; see the source for copying conditions. There is NO
|
|
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
@c man end
|
|
|
|
@c man begin SEEALSO
|
|
qemu(1), qemu-img(1)
|
|
@c man end
|
|
|
|
@end ignore
|