qemu/chardev
Daniel P. Berrange fd4a5fd463 chardev: add support for authorization for TLS clients
Currently any client which can complete the TLS handshake is able to use
a chardev server. The server admin can turn on the 'verify-peer' option
for the x509 creds to require the client to provide a x509
certificate. This means the client will have to acquire a certificate
from the CA before they are permitted to use the chardev server. This is
still a fairly low bar.

This adds a 'tls-authz=OBJECT-ID' option to the socket chardev backend
which takes the ID of a previously added 'QAuthZ' object instance. This
will be used to validate the client's x509 distinguished name. Clients
failing the check will not be permitted to use the chardev server.

For example to setup authorization that only allows connection from a
client whose x509 certificate distinguished name contains 'CN=fred', you
would use:

  $QEMU -object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
                endpoint=server,verify-peer=yes \
        -object authz-simple,id=authz0,identity=CN=laptop.example.com,,\
                O=Example Org,,L=London,,ST=London,,C=GB \
        -chardev socket,host=127.0.0.1,port=9000,server,\
	         tls-creds=tls0,tls-authz=authz0 \
        ...other qemu args...

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2019-03-11 16:55:52 +01:00
..
Makefile.objs buildsys: Move brlapi libs to per object 2017-09-22 10:20:34 +08:00
baum.c baum: Truncate braille device size to 84x1 2017-12-21 09:22:44 +01:00
char-console.c chardev: move headers to include/chardev 2017-06-02 11:33:52 +04:00
char-fd.c chardev: remove context in chr_update_read_handler 2017-09-22 21:07:27 +02:00
char-fe.c char: update the mux handlers in class callback 2019-02-13 15:36:14 +01:00
char-file.c Move include qemu/option.h from qemu-common.h to actual users 2018-02-09 13:52:16 +01:00
char-io.c chardev: use a child source for qio input source 2018-10-03 14:45:05 +04:00
char-mux.c char: update the mux handlers in class callback 2019-02-13 15:36:14 +01:00
char-null.c chardev: move headers to include/chardev 2017-06-02 11:33:52 +04:00
char-parallel.c Move include qemu/option.h from qemu-common.h to actual users 2018-02-09 13:52:16 +01:00
char-pipe.c Move include qemu/option.h from qemu-common.h to actual users 2018-02-09 13:52:16 +01:00
char-pty.c char-pty: remove write_lock usage 2019-02-13 16:46:39 +01:00
char-ringbuf.c Include less of the generated modular QAPI headers 2018-03-02 13:45:50 -06:00
char-serial.c chardev: ensure termios is fully initialized 2019-02-12 17:35:56 +01:00
char-socket.c chardev: add support for authorization for TLS clients 2019-03-11 16:55:52 +01:00
char-stdio.c chardev: don't splatter terminal settings on exit if not previously set 2018-06-28 19:05:30 +02:00
char-udp.c Move include qemu/option.h from qemu-common.h to actual users 2018-02-09 13:52:16 +01:00
char-win-stdio.c chardev: move headers to include/chardev 2017-06-02 11:33:52 +04:00
char-win.c chardev: move headers to include/chardev 2017-06-02 11:33:52 +04:00
char.c chardev: add support for authorization for TLS clients 2019-03-11 16:55:52 +01:00
msmouse.c char: move char devices to chardev/ 2017-06-02 11:33:53 +04:00
spice.c char: register spice ports after spice started 2019-02-21 14:09:17 +01:00
testdev.c char: move char devices to chardev/ 2017-06-02 11:33:53 +04:00
trace-events char/spice: discard write() if backend is disconnected 2019-02-21 14:09:17 +01:00
wctablet.c chardev/wctablet: Fix a typo 2019-02-13 14:31:31 +01:00