diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2022-03-04 19:36:03 +0000 |
|---|---|---|
| committer | Eric Blake <eblake@redhat.com> | 2022-03-07 15:58:42 -0600 |
| commit | e8ae8b1a75e8f6420c37be31797bd13aa7e95778 (patch) | |
| tree | e8184f49199a8a0ecc046a11c0e293bf3e644eb3 /qemu-nbd.c | |
| parent | 003b2b252112572cd8c92bffe5e532a53b28d1e4 (diff) | |
| download | focaccia-qemu-e8ae8b1a75e8f6420c37be31797bd13aa7e95778.tar.gz focaccia-qemu-e8ae8b1a75e8f6420c37be31797bd13aa7e95778.zip | |
block/nbd: don't restrict TLS usage to IP sockets
The TLS usage for NBD was restricted to IP sockets because validating x509 certificates requires knowledge of the hostname that the client is connecting to. TLS does not have to use x509 certificates though, as PSK (pre-shared keys) provide an alternative credential option. These have no requirement for a hostname and can thus be trivially used for UNIX sockets. Furthermore, with the ability to overide the default hostname for TLS validation in the previous patch, it is now also valid to want to use x509 certificates with FD passing and UNIX sockets. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20220304193610.3293146-6-berrange@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
Diffstat (limited to 'qemu-nbd.c')
| -rw-r--r-- | qemu-nbd.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/qemu-nbd.c b/qemu-nbd.c index 18d281aba3..713e7557a9 100644 --- a/qemu-nbd.c +++ b/qemu-nbd.c @@ -808,7 +808,9 @@ int main(int argc, char **argv) socket_activation = check_socket_activation(); if (socket_activation == 0) { - setup_address_and_port(&bindto, &port); + if (!sockpath) { + setup_address_and_port(&bindto, &port); + } } else { /* Using socket activation - check user didn't use -p etc. */ const char *err_msg = socket_activation_validate_opts(device, sockpath, @@ -829,10 +831,6 @@ int main(int argc, char **argv) } if (tlscredsid) { - if (sockpath) { - error_report("TLS is only supported with IPv4/IPv6"); - exit(EXIT_FAILURE); - } if (device) { error_report("TLS is not supported with a host device"); exit(EXIT_FAILURE); |