diff options
| author | Daniel P. Berrange <berrange@redhat.com> | 2019-02-27 16:20:34 +0000 |
|---|---|---|
| committer | Eric Blake <eblake@redhat.com> | 2019-03-06 11:05:27 -0600 |
| commit | 000194556b65970a19ca437cd96b804a3f069f11 (patch) | |
| tree | 3ca23aafe1f56a6e1345be4f2700a1f846a4bf71 /include | |
| parent | b25e12daff2c3e5ba933f85e8ba278f5bcba8f4d (diff) | |
nbd: allow authorization with nbd-server-start QMP command
As with the previous patch to qemu-nbd, the nbd-server-start QMP command
also needs to be able to specify authorization when enabling TLS encryption.
First the client must create a QAuthZ object instance using the
'object-add' command:
{
'execute': 'object-add',
'arguments': {
'qom-type': 'authz-list',
'id': 'authz0',
'parameters': {
'policy': 'deny',
'rules': [
{
'match': '*CN=fred',
'policy': 'allow'
}
]
}
}
}
They can then reference this in the new 'tls-authz' parameter when
executing the 'nbd-server-start' command:
{
'execute': 'nbd-server-start',
'arguments': {
'addr': {
'type': 'inet',
'host': '127.0.0.1',
'port': '9000'
},
'tls-creds': 'tls0',
'tls-authz': 'authz0'
}
}
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <20190227162035.18543-3-berrange@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/block/nbd.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/block/nbd.h b/include/block/nbd.h index b742ec4a89..6d05983a55 100644 --- a/include/block/nbd.h +++ b/include/block/nbd.h @@ -332,7 +332,7 @@ void nbd_client_get(NBDClient *client); void nbd_client_put(NBDClient *client); void nbd_server_start(SocketAddress *addr, const char *tls_creds, - Error **errp); + const char *tls_authz, Error **errp); /* nbd_read * Reads @size bytes from @ioc. Returns 0 on success. |