diff options
author | Richard W.M. Jones <rjones@redhat.com> | 2018-07-03 09:03:03 +0100 |
---|---|---|
committer | Daniel P. Berrangé <berrange@redhat.com> | 2018-07-03 13:04:38 +0100 |
commit | e1a6dc91ddb55ef77a705b62b6e62634631fd57d (patch) | |
tree | d5f8bd5ceacbe81dce54056209efa0fffe3a52c7 /crypto/trace-events | |
parent | 9b75dcb15f562577a937ae01f324946513586e59 (diff) | |
download | qemu-e1a6dc91ddb55ef77a705b62b6e62634631fd57d.zip qemu-e1a6dc91ddb55ef77a705b62b6e62634631fd57d.tar.gz qemu-e1a6dc91ddb55ef77a705b62b6e62634631fd57d.tar.bz2 |
crypto: Implement TLS Pre-Shared Keys (PSK).
Pre-Shared Keys (PSK) is a simpler mechanism for enabling TLS
connections than using certificates. It requires only a simple secret
key:
$ mkdir -m 0700 /tmp/keys
$ psktool -u rjones -p /tmp/keys/keys.psk
$ cat /tmp/keys/keys.psk
rjones:d543770c15ad93d76443fb56f501a31969235f47e999720ae8d2336f6a13fcbc
The key can be secretly shared between clients and servers. Clients
must specify the directory containing the "keys.psk" file and a
username (defaults to "qemu"). Servers must specify only the
directory.
Example NBD client:
$ qemu-img info \
--object tls-creds-psk,id=tls0,dir=/tmp/keys,username=rjones,endpoint=client \
--image-opts \
file.driver=nbd,file.host=localhost,file.port=10809,file.tls-creds=tls0,file.export=/
Example NBD server using qemu-nbd:
$ qemu-nbd -t -x / \
--object tls-creds-psk,id=tls0,endpoint=server,dir=/tmp/keys \
--tls-creds tls0 \
image.qcow2
Example NBD server using nbdkit:
$ nbdkit -n -e / -fv \
--tls=on --tls-psk=/tmp/keys/keys.psk \
file file=disk.img
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'crypto/trace-events')
-rw-r--r-- | crypto/trace-events | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/crypto/trace-events b/crypto/trace-events index e589990..597389b 100644 --- a/crypto/trace-events +++ b/crypto/trace-events @@ -7,6 +7,9 @@ qcrypto_tls_creds_get_path(void *creds, const char *filename, const char *path) # crypto/tlscredsanon.c qcrypto_tls_creds_anon_load(void *creds, const char *dir) "TLS creds anon load creds=%p dir=%s" +# crypto/tlscredspsk.c +qcrypto_tls_creds_psk_load(void *creds, const char *dir) "TLS creds psk load creds=%p dir=%s" + # crypto/tlscredsx509.c qcrypto_tls_creds_x509_load(void *creds, const char *dir) "TLS creds x509 load creds=%p dir=%s" qcrypto_tls_creds_x509_check_basic_constraints(void *creds, const char *file, int status) "TLS creds x509 check basic constraints creds=%p file=%s status=%d" |