Skip to content
Snippets Groups Projects
  • Daniel P. Berrangé's avatar
    e8ae8b1a
    block/nbd: don't restrict TLS usage to IP sockets · e8ae8b1a
    Daniel P. Berrangé authored
    
    The TLS usage for NBD was restricted to IP sockets because validating
    x509 certificates requires knowledge of the hostname that the client
    is connecting to.
    
    TLS does not have to use x509 certificates though, as PSK (pre-shared
    keys) provide an alternative credential option. These have no
    requirement for a hostname and can thus be trivially used for UNIX
    sockets.
    
    Furthermore, with the ability to overide the default hostname for
    TLS validation in the previous patch, it is now also valid to want
    to use x509 certificates with FD passing and UNIX sockets.
    
    Reviewed-by: default avatarEric Blake <eblake@redhat.com>
    Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
    Message-Id: <20220304193610.3293146-6-berrange@redhat.com>
    Signed-off-by: default avatarEric Blake <eblake@redhat.com>
    e8ae8b1a
    History
    block/nbd: don't restrict TLS usage to IP sockets
    Daniel P. Berrangé authored
    
    The TLS usage for NBD was restricted to IP sockets because validating
    x509 certificates requires knowledge of the hostname that the client
    is connecting to.
    
    TLS does not have to use x509 certificates though, as PSK (pre-shared
    keys) provide an alternative credential option. These have no
    requirement for a hostname and can thus be trivially used for UNIX
    sockets.
    
    Furthermore, with the ability to overide the default hostname for
    TLS validation in the previous patch, it is now also valid to want
    to use x509 certificates with FD passing and UNIX sockets.
    
    Reviewed-by: default avatarEric Blake <eblake@redhat.com>
    Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
    Message-Id: <20220304193610.3293146-6-berrange@redhat.com>
    Signed-off-by: default avatarEric Blake <eblake@redhat.com>