diff options
author | Daniel P. Berrange <berrange@redhat.com> | 2015-03-13 17:39:26 +0000 |
---|---|---|
committer | Daniel P. Berrange <berrange@redhat.com> | 2015-09-15 15:00:20 +0100 |
commit | e00adf6c3edf8dbbe7eb60c94e24fe2158e8342f (patch) | |
tree | bce3971fd6eb9fcdf5494a74c01a808b863c708b /qemu-options.hx | |
parent | a090187de116a3d0b8146ca481249c8fc83ad3ee (diff) | |
download | qemu-e00adf6c3edf8dbbe7eb60c94e24fe2158e8342f.zip qemu-e00adf6c3edf8dbbe7eb60c94e24fe2158e8342f.tar.gz qemu-e00adf6c3edf8dbbe7eb60c94e24fe2158e8342f.tar.bz2 |
crypto: introduce new module for TLS anonymous credentials
Introduce a QCryptoTLSCredsAnon class which is used to
manage anonymous TLS credentials. Use of this class is
generally discouraged since it does not offer strong
security, but it is required for backwards compatibility
with the current VNC server implementation.
Simple example CLI configuration:
$QEMU -object tls-creds-anon,id=tls0,endpoint=server
Example using pre-created diffie-hellman parameters
$QEMU -object tls-creds-anon,id=tls0,endpoint=server,\
dir=/path/to/creds/dir
The 'id' value in the -object args will be used to associate the
credentials with the network services. For example, when the VNC
server is later converted it would use
$QEMU -object tls-creds-anon,id=tls0,.... \
-vnc 127.0.0.1:1,tls-creds=tls0
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Diffstat (limited to 'qemu-options.hx')
-rw-r--r-- | qemu-options.hx | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/qemu-options.hx b/qemu-options.hx index 166eae6..625f306 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3571,6 +3571,26 @@ the @option{virtio-rng} device. The @option{chardev} parameter is the unique ID of a character device backend that provides the connection to the RNG daemon. +@item -object tls-creds-anon,id=@var{id},endpoint=@var{endpoint},dir=@var{/path/to/cred/dir},verify-peer=@var{on|off} + +Creates a TLS anonymous credentials object, which can be used to provide +TLS support on network backends. The @option{id} parameter is a unique +ID which network backends will use to access the credentials. The +@option{endpoint} is either @option{server} or @option{client} depending +on whether the QEMU network backend that uses the credentials will be +acting as a client or as a server. If @option{verify-peer} is enabled +(the default) then once the handshake is completed, the peer credentials +will be verified, though this is a no-op for anonymous credentials. + +The @var{dir} parameter tells QEMU where to find the credential +files. For server endpoints, this directory may contain a file +@var{dh-params.pem} providing diffie-hellman parameters to use +for the TLS server. If the file is missing, QEMU will generate +a set of DH parameters at startup. This is a computationally +expensive operation that consumes random pool entropy, so it is +recommended that a persistent set of parameters be generated +upfront and saved. + @end table ETEXI |