mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
42478dacc8
qemu/crypto
History
Richard W.M. Jones e1a6dc91dd crypto: Implement TLS Pre-Shared Keys (PSK). 
Pre-Shared Keys (PSK) is a simpler mechanism for enabling TLS
connections than using certificates.  It requires only a simple secret
key:

  $ mkdir -m 0700 /tmp/keys
  $ psktool -u rjones -p /tmp/keys/keys.psk
  $ cat /tmp/keys/keys.psk
  rjones:d543770c15ad93d76443fb56f501a31969235f47e999720ae8d2336f6a13fcbc

The key can be secretly shared between clients and servers.  Clients
must specify the directory containing the "keys.psk" file and a
username (defaults to "qemu").  Servers must specify only the
directory.

Example NBD client:

  $ qemu-img info \
    --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=rjones,endpoint=client \
    --image-opts \
    file.driver=nbd,file.host=localhost,file.port=10809,file.tls-creds=tls0,file.export=/

Example NBD server using qemu-nbd:

  $ qemu-nbd -t -x / \
    --object tls-creds-psk,id=tls0,endpoint=server,dir=/tmp/keys \
    --tls-creds tls0 \
    image.qcow2

Example NBD server using nbdkit:

  $ nbdkit -n -e / -fv \
    --tls=on --tls-psk=/tmp/keys/keys.psk \
    file file=disk.img

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-07-03 13:04:38 +01:00
..
aes.c
afalg.c crypto: introduce some common functions for af_alg backend 2017-07-19 10:11:05 +01:00
afalgpriv.h crypto: hash: add afalg-backend hash support 2017-07-19 10:11:05 +01:00
afsplit.c
block-luks.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
block-luks.h crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
block-qcow.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
block-qcow.h crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
block.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
blockpriv.h block: convert qcrypto_block_encrypt|decrypt to take bytes offset 2017-10-06 16:30:47 +02:00
cipher-afalg.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
cipher-builtin.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
cipher-gcrypt.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
cipher-nettle.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
cipher.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
cipherpriv.h Include less of the generated modular QAPI headers 2018-03-02 13:45:50 -06:00
desrfb.c
hash-afalg.c crypto: hmac: add af_alg-backend hmac support 2017-07-19 10:11:05 +01:00
hash-gcrypt.c crypto: hash: add hash driver framework 2017-07-19 10:11:04 +01:00
hash-glib.c glib: bump min required glib library version to 2.40 2018-06-29 12:22:28 +01:00
hash-nettle.c crypto: hash: add hash driver framework 2017-07-19 10:11:04 +01:00
hash.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
hashpriv.h crypto: hash: add afalg-backend hash support 2017-07-19 10:11:05 +01:00
hmac-gcrypt.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
hmac-glib.c glib: bump min required glib library version to 2.40 2018-06-29 12:22:28 +01:00
hmac-nettle.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
hmac.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
hmacpriv.h crypto: hmac: add af_alg-backend hmac support 2017-07-19 10:11:05 +01:00
init.c crypto: qcrypto_random_bytes() now works on windows w/o any other crypto libs 2017-05-09 14:41:47 +01:00
ivgen-essiv.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
ivgen-essiv.h crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
ivgen-plain64.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
ivgen-plain64.h crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
ivgen-plain.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
ivgen-plain.h crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
ivgen.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
ivgenpriv.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
Makefile.objs crypto: Implement TLS Pre-Shared Keys (PSK). 2018-07-03 13:04:38 +01:00
pbkdf-gcrypt.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
pbkdf-nettle.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
pbkdf-stub.c crypto: use uint64_t for pbkdf iteration count parameters 2016-09-19 16:30:42 +01:00
pbkdf.c crypto: use correct derived key size when timing pbkdf 2016-09-19 16:30:45 +01:00
random-gcrypt.c crypto: qcrypto_random_bytes() now works on windows w/o any other crypto libs 2017-05-09 14:41:47 +01:00
random-gnutls.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
random-platform.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
secret.c qapi: Change data type of the FOO_lookup generated for enum FOO 2017-09-04 13:09:13 +02:00
tlscreds.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
tlscredsanon.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
tlscredspriv.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
tlscredspsk.c crypto: Implement TLS Pre-Shared Keys (PSK). 2018-07-03 13:04:38 +01:00
tlscredsx509.c crypto: use local path for local headers 2018-06-01 19:20:37 +03:00
tlssession.c crypto: Implement TLS Pre-Shared Keys (PSK). 2018-07-03 13:04:38 +01:00
trace-events crypto: Implement TLS Pre-Shared Keys (PSK). 2018-07-03 13:04:38 +01:00
xts.c