OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
b25e12daff
qemu-e2k/tests
History
Daniel P. Berrange b25e12daff qemu-nbd: add support for authorization of TLS clients 
Currently any client which can complete the TLS handshake is able to use
the NBD server. The server admin can turn on the 'verify-peer' option
for the x509 creds to require the client to provide a x509 certificate.
This means the client will have to acquire a certificate from the CA
before they are permitted to use the NBD server. This is still a fairly
low bar to cross.

This adds a '--tls-authz OBJECT-ID' option to the qemu-nbd command which
takes the ID of a previously added 'QAuthZ' object instance. This will
be used to validate the client's x509 distinguished name. Clients
failing the authorization check will not be permitted to use the NBD
server.

For example to setup authorization that only allows connection from a client
whose x509 certificate distinguished name is

   CN=laptop.example.com,O=Example Org,L=London,ST=London,C=GB

escape the commas in the name and use:

  qemu-nbd --object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
                    endpoint=server,verify-peer=yes \
           --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\
                     O=Example Org,,L=London,,ST=London,,C=GB' \
           --tls-creds tls0 \
           --tls-authz authz0 \
	   ....other qemu-nbd args...

NB: a real shell command line would not have leading whitespace after
the line continuation, it is just included here for clarity.

Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <20190227162035.18543-2-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: split long line in --help text, tweak 233 to show that whitespace
after ,, in identity= portion is actually okay]
Signed-off-by: Eric Blake <eblake@redhat.com>
2019-03-06 11:05:27 -06:00
..
acceptance Acceptance tests: add Linux initrd checking test 2019-01-17 17:52:40 -02:00
data tests/data: introduce "uefi-boot-images" with the "bios-tables-test" ISOs 2019-02-21 12:28:41 -05:00
decode
docker tests/docker: peg netmap code to a specific version 2019-02-22 09:32:32 +00:00
fp softfloat: Support float_round_to_odd more places 2019-02-26 14:08:03 +00:00
guest-debug
image-fuzzer
keys
libqos qemu/queue.h: simplify reverse access to QTAILQ 2019-01-11 15:46:55 +01:00
migration
multiboot
qapi-schema qapi: Fix array first used in a different module 2019-03-05 14:43:11 +01:00
qemu-iotests qemu-nbd: add support for authorization of TLS clients 2019-03-06 11:05:27 -06:00
rocker
tcg target/mips: Add tests for integer add MSA instruction group 2019-03-05 17:05:33 +01:00
uefi-test-tools tests/uefi-test-tools: add build scripts 2019-02-21 12:28:41 -05:00
vm tests/vm: Be verbose while extracting compressed images 2019-02-11 12:47:08 +00:00
vmstate-static-checker-data
.gitignore qapi: Fix code generation for sub-modules in other directories 2019-03-05 14:43:11 +01:00
ac97-test.c
acpi-utils.c tests: acpi: reuse fetch_table() in vmgenid-test 2019-01-17 21:10:57 -05:00
acpi-utils.h tests: acpi: use AcpiSdtTable::aml instead of AcpiSdtTable::header::signature 2019-01-17 21:10:57 -05:00
ahci-test.c
atomic64-bench.c tests: use g_usleep instead of rem = sleep(time) 2019-01-14 14:52:30 +00:00
atomic_add-bench.c tests: use g_usleep instead of rem = sleep(time) 2019-01-14 14:52:30 +00:00
benchmark-crypto-cipher.c
benchmark-crypto-hash.c
benchmark-crypto-hmac.c
bios-tables-test.c tests: acpi: use AcpiSdtTable::aml instead of AcpiSdtTable::header::signature 2019-01-17 21:10:57 -05:00
boot-order-test.c tests/boot-order: Make test independent of global_qtest 2019-01-22 05:14:32 +01:00
boot-sector.c
boot-sector.h
boot-serial-test.c tests: Exit boot-serial-test loop if child dies 2018-12-17 15:37:50 +01:00
cdrom-test.c tests/cdrom-test: only include isapc cdrom test when g_test_slow() 2019-02-22 09:32:32 +00:00
check-block-qdict.c
check-block.sh qemu-iotests: convert pwd and $(pwd) to $PWD 2018-11-19 10:08:19 -06:00
check-qdict.c
check-qjson.c json: Fix % handling when not interpolating 2019-01-24 15:20:59 +01:00
check-qlist.c
check-qlit.c
check-qnull.c
check-qnum.c
check-qobject.c
check-qom-interface.c qom: make interface types abstract 2018-12-11 15:45:22 -02:00
check-qom-proplist.c
check-qstring.c
cpu-plug-test.c hw/i386: Remove deprecated machines pc-0.10 and pc-0.11 2018-12-20 11:19:12 -05:00
crypto-tls-psk-helpers.c
crypto-tls-psk-helpers.h
crypto-tls-x509-helpers.c
crypto-tls-x509-helpers.h
device-introspect-test.c
device-plug-test.c tests/device-plug: Add PHB unplug request test for spapr 2019-02-26 09:21:25 +11:00
display-vga-test.c tests/display-vga: Enable virtio-vga test 2019-01-11 11:45:00 +01:00
drive_del-test.c
ds1338-test.c
e1000-test.c
e1000e-test.c
eepro100-test.c
endianness-test.c tests/endianesss: Make test independent of global_qtest 2019-01-22 05:14:32 +01:00
es1370-test.c
fdc-test.c tests: Remove (mostly) useless architecture checks 2019-03-06 10:10:36 +01:00
fw_cfg-test.c
hd-geo-test.c
hexloader-test.c tests/hexloader-test: Don't pass -nographic to the QEMU under test 2019-01-22 06:26:32 +01:00
i440fx-test.c
i82801b11-test.c
ide-test.c tests: Remove (mostly) useless architecture checks 2019-03-06 10:10:36 +01:00
intel-hda-test.c
io-channel-helpers.c
io-channel-helpers.h
ioh3420-test.c
iothread.c
iothread.h
ipmi-bt-test.c tests: Remove (mostly) useless architecture checks 2019-03-06 10:10:36 +01:00
ipmi-kcs-test.c tests: Remove (mostly) useless architecture checks 2019-03-06 10:10:36 +01:00
ipoctal232-test.c
ivshmem-test.c chardev: forbid 'wait' option with client sockets 2019-02-12 17:35:56 +01:00
libqtest.c chardev: forbid 'wait' option with client sockets 2019-02-12 17:35:56 +01:00
libqtest.h tests/libqtest: Introduce qtest_init_with_serial() 2019-01-29 11:46:04 +00:00
m25p80-test.c
m48t59-test.c
machine-none-test.c tests/machine-none: Make test independent of global_qtest 2018-12-17 15:36:40 +01:00
Makefile.include qapi: Fix code generation for sub-modules in other directories 2019-03-05 14:43:11 +01:00
megasas-test.c
microbit-test.c tests/microbit-test: Add tests for nRF51 NVMC 2019-02-01 15:32:17 +00:00
migration-test.c tests: Add basic migration precopy tcp test 2019-03-06 10:49:17 +00:00
ne2000-test.c
numa-test.c
nvme-test.c nvme: fix out-of-bounds access to the CMB 2018-11-22 16:43:52 +01:00
pca9552-test.c
pcnet-test.c
pkix_asn1_tab.c
pnv-xscom-test.c tests/pnv-xscom: Make test independent of global_qtest 2019-01-22 05:14:32 +01:00
prom-env-test.c tests/prom-env: Make test independent of global_qtest 2018-12-17 15:36:40 +01:00
ptimer-test-stubs.c
ptimer-test.c
ptimer-test.h
pvpanic-test.c tests/pvpanic: Make the pvpanic test independent of global_qtest 2018-12-17 15:36:40 +01:00
pxe-test.c tests/pxe: Make test independent of global_qtest 2018-12-17 15:36:40 +01:00
q35-test.c
qemu-iotests-quick.sh
qht-bench.c tests: use g_usleep instead of rem = sleep(time) 2019-01-14 14:52:30 +00:00
qmp-cmd-test.c
qmp-test.c Revert "tests: Add parameter to qtest_init_without_qmp_handshake" 2018-12-12 10:28:27 +01:00
qom-test.c
rcutorture.c
requirements.txt
rtas-test.c
rtc-test.c
rtl8139-test.c
sdhci-test.c
socket-helpers.c
socket-helpers.h
spapr-phb-test.c
tco-test.c
test-aio-multithread.c
test-aio.c
test-announce-self.c tests: Add a test for qemu self announcements 2019-03-05 11:27:41 +08:00
test-arm-mptimer.c tests/test-arm-mptimer: Don't leak string memory 2018-12-14 13:30:54 +00:00
test-authz-list.c authz: add QAuthZList object type for an access control list 2019-02-26 15:32:18 +00:00
test-authz-listfile.c authz: add QAuthZListFile object type for a file access control list 2019-02-26 15:32:18 +00:00
test-authz-pam.c authz: add QAuthZPAM object type for authorizing using PAM 2019-02-26 15:32:19 +00:00
test-authz-simple.c authz: add QAuthZSimple object type for easy whitelist auth checks 2019-02-26 15:25:58 +00:00
test-base64.c
test-bdrv-drain.c Block layer patches: 2019-02-26 19:04:47 +00:00
test-bdrv-graph-mod.c tests: add test-bdrv-graph-mod 2019-02-25 15:03:19 +01:00
test-bitcnt.c
test-bitops.c
test-block-backend.c
test-block-iothread.c block: Fix hangs in synchronous APIs with iothreads 2019-02-01 13:46:44 +01:00
test-blockjob-txn.c
test-blockjob.c
test-bufferiszero.c
test-char.c char: allow specifying a GMainContext at opening time 2019-02-13 14:23:39 +01:00
test-clone-visitor.c tests: Rename UserDefNativeListUnion to UserDefListUnion 2019-03-05 14:43:11 +01:00
test-coroutine.c
test-crypto-afsplit.c
test-crypto-block.c crypto: support multiple threads accessing one QCryptoBlock 2018-12-12 11:16:49 +00:00
test-crypto-cipher.c
test-crypto-hash.c
test-crypto-hmac.c
test-crypto-ivgen.c
test-crypto-pbkdf.c test: execute g_test_run when tests are skipped 2019-01-11 13:57:25 +01:00
test-crypto-secret.c
test-crypto-tlscredsx509.c
test-crypto-tlssession.c authz: delete existing ACL implementation 2019-02-26 15:32:19 +00:00
test-crypto-xts.c
test-cutils.c cutils: Fix qemu_strtosz() & friends to reject non-finite sizes 2018-12-13 19:10:06 +01:00
test-filter-mirror.c test-filter-mirror: pass UNIX domain socket through fd 2019-02-04 16:03:20 +00:00
test-filter-redirector.c chardev: forbid 'wait' option with client sockets 2019-02-12 17:35:56 +01:00
test-hbitmap.c Revert "hbitmap: Add @advance param to hbitmap_iter_next()" 2019-01-15 18:26:50 -05:00
test-hmp.c hmp: Add hmp_announce_self 2019-03-05 11:27:41 +08:00
test-image-locking.c
test-int128.c
test-io-channel-buffer.c
test-io-channel-command.c
test-io-channel-file.c
test-io-channel-socket.c io: ensure UNIX client doesn't unlink server socket 2019-01-24 12:23:35 +00:00
test-io-channel-tls.c authz: delete existing ACL implementation 2019-02-26 15:32:19 +00:00
test-io-task.c
test-iov.c
test-keyval.c
test-logging.c
test-mul64.c
test-netfilter.c
test-opts-visitor.c
test-qapi-util.c
test-qdev-global-props.c qdev: all globals are now user-provided 2019-01-07 16:18:42 +04:00
test-qdist.c
test-qemu-opts.c
test-qga.c
test-qht-par.c
test-qht.c
test-qmp-cmds.c tests: Rename UserDefNativeListUnion to UserDefListUnion 2019-03-05 14:43:11 +01:00
test-qmp-event.c qapi: Generate QAPIEvent stuff into separate files 2019-02-18 14:44:04 +01:00
test-qobject-input-visitor.c tests: Rename UserDefNativeListUnion to UserDefListUnion 2019-03-05 14:43:11 +01:00
test-qobject-output-visitor.c tests: Rename UserDefNativeListUnion to UserDefListUnion 2019-03-05 14:43:11 +01:00
test-rcu-list.c qemu/queue.h: leave head structs anonymous unless necessary 2019-01-11 15:46:55 +01:00
test-rcu-simpleq.c
test-rcu-tailq.c
test-replication.c
test-shift128.c
test-string-input-visitor.c test-string-input-visitor: Add range overflow tests 2018-12-13 19:10:06 +01:00
test-string-output-visitor.c
test-thread-pool.c
test-throttle.c
test-timed-average.c
test-util-filemonitor.c util: add helper APIs for dealing with inotify in portable manner 2019-02-26 15:25:58 +00:00
test-util-sockets.c
test-uuid.c
test-visitor-serialization.c
test-vmstate.c tests: add /vmstate/simple/array 2019-01-23 15:51:47 +00:00
test-write-threshold.c
test-x86-cpuid-compat.c
test-x86-cpuid.c
test-xbzrle.c
tmp105-test.c
tpci200-test.c
tpm-crb-swtpm-test.c
tpm-crb-test.c
tpm-emu.c
tpm-emu.h
tpm-tests.c
tpm-tests.h
tpm-tis-swtpm-test.c
tpm-tis-test.c
tpm-util.c
tpm-util.h Clean up includes 2018-12-20 10:29:08 +01:00
usb-hcd-ehci-test.c
usb-hcd-ohci-test.c
usb-hcd-uhci-test.c
usb-hcd-xhci-test.c
vhost-user-bridge.c Clean up includes 2018-12-20 10:29:08 +01:00
vhost-user-test.c vhost-user-test: create a temporary directory per TestServer 2019-02-21 12:28:01 -05:00
virtio-9p-test.c
virtio-balloon-test.c
virtio-blk-test.c tests/virtio-blk: add test for DISCARD command 2019-02-22 09:42:17 +00:00
virtio-ccw-test.c
virtio-console-test.c
virtio-net-test.c virtio-net-test: add large tx buffer test 2018-12-04 11:06:15 +00:00
virtio-rng-test.c
virtio-scsi-test.c
virtio-serial-test.c
vmgenid-test.c uuid: Make qemu_uuid_bswap() take and return a QemuUUID 2019-02-01 13:46:45 +01:00
vmxnet3-test.c
wdt_ib700-test.c