e1a6dc91dd
Pre-Shared Keys (PSK) is a simpler mechanism for enabling TLS
connections than using certificates. It requires only a simple secret
key:
$ mkdir -m 0700 /tmp/keys
$ psktool -u rjones -p /tmp/keys/keys.psk
$ cat /tmp/keys/keys.psk
rjones:d543770c15ad93d76443fb56f501a31969235f47e999720ae8d2336f6a13fcbc
The key can be secretly shared between clients and servers. Clients
must specify the directory containing the "keys.psk" file and a
username (defaults to "qemu"). Servers must specify only the
directory.
Example NBD client:
$ qemu-img info \
--object tls-creds-psk,id=tls0,dir=/tmp/keys,username=rjones,endpoint=client \
--image-opts \
file.driver=nbd,file.host=localhost,file.port=10809,file.tls-creds=tls0,file.export=/
Example NBD server using qemu-nbd:
$ qemu-nbd -t -x / \
--object tls-creds-psk,id=tls0,endpoint=server,dir=/tmp/keys \
--tls-creds tls0 \
image.qcow2
Example NBD server using nbdkit:
$ nbdkit -n -e / -fv \
--tls=on --tls-psk=/tmp/keys/keys.psk \
file file=disk.img
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
51 lines
1.4 KiB
C
51 lines
1.4 KiB
C
/*
|
|
* Copyright (C) 2015-2018 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library. If not, see
|
|
* <http://www.gnu.org/licenses/>.
|
|
*
|
|
* Author: Richard W.M. Jones <rjones@redhat.com>
|
|
*/
|
|
|
|
#include "qemu/osdep.h"
|
|
|
|
/* Include this first because it defines QCRYPTO_HAVE_TLS_TEST_SUPPORT */
|
|
#include "crypto-tls-x509-helpers.h"
|
|
|
|
#include "crypto-tls-psk-helpers.h"
|
|
#include "qemu/sockets.h"
|
|
|
|
#ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT
|
|
|
|
void test_tls_psk_init(const char *pskfile)
|
|
{
|
|
FILE *fp;
|
|
|
|
fp = fopen(pskfile, "w");
|
|
if (fp == NULL) {
|
|
g_critical("Failed to create pskfile %s", pskfile);
|
|
abort();
|
|
}
|
|
/* Don't do this in real applications! Use psktool. */
|
|
fprintf(fp, "qemu:009d5638c40fde0c\n");
|
|
fclose(fp);
|
|
}
|
|
|
|
void test_tls_psk_cleanup(const char *pskfile)
|
|
{
|
|
unlink(pskfile);
|
|
}
|
|
|
|
#endif /* QCRYPTO_HAVE_TLS_TEST_SUPPORT */
|