search for: set_uri_allow_transport

Previous discussion: https://www.redhat.com/archives/libguestfs/2019-August/msg00102.html Last night I experimentally added support for URIs that contain the query parameter tls-psk-file, as part of rewriting the tests to cover more of the URI code. So you can now have a URI like: nbds://alice@localhost/?tls-psk-file=keys.psk However there's an obvious security problem here because now

...;, 1 lsl 1; + "VSOCK", 1 lsl 2; + ] +} +let all_flags = [ cmd_flags; handshake_flags; allow_transport_flags ] (* Calls. * @@ -1445,6 +1453,75 @@ C<\"qemu:dirty-bitmap:...\"> for qemu-nbd see_also = ["L<nbd_block_status(3)>"]; }; + "set_uri_allow_transports", { + default_call with + args = [ Flags ("mask", allow_transport_flags) ]; ret = RErr; + permitted_states = [ Created ]; + shortdesc = "set the allowed transports in NBD URIs"; + longdesc = "\ +Set which transports are allowed to appear in NBD URIs. T...

...is *disabled* by default for obvious security reasons. > All other features are enabled by default. > --- > @@ -1445,6 +1453,75 @@ C<\"qemu:dirty-bitmap:...\"> for qemu-nbd > see_also = ["L<nbd_block_status(3)>"]; > }; > > + "set_uri_allow_transports", { > + default_call with > + args = [ Flags ("mask", allow_transport_flags) ]; ret = RErr; > + permitted_states = [ Created ]; > + shortdesc = "set the allowed transports in NBD URIs"; > + longdesc = "\ > +Set which transports are all...

...t export +queries."; + see_also = [Link "block_status"; Link "can_meta_context"; + Link "add_meta_context"; Link "get_nr_meta_contexts"; + Link "get_meta_context"; Link "set_opt_mode"]; }; "set_uri_allow_transports", { @@ -2814,6 +2881,9 @@ let first_version = [ (* Added in 1.5.x development cycle, will be stable and supported in 1.6. *) "set_strict_mode", (1, 6); "get_strict_mode", (1, 6); + "get_nr_meta_contexts", (1, 6); + "get_meta_context", (1, 6);...

...Link "can_meta_context"; Link "block_status"]; + Link "can_meta_context"; Link "block_status"; + Link "get_init_flags"]; }; "aio_get_fd", { @@ -3031,6 +3057,7 @@ let first_version = [ "set_uri_allow_transports", (1, 2); "set_uri_allow_tls", (1, 2); "set_uri_allow_local_file", (1, 2); + "get_init_flags", (1, 2); (* These calls are proposed for a future version of libnbd, but * have not been added to any released version so far. @@ -3039,7 +3066,7 @@ let f...

I'm posting this now, as I'm at the end of a workday and I got things working for manual experimentation. Still to do: - write interop tests for qemu-nbd and nbdkit (including my proposed patch addition of qemu-nbd -A to show qemu:allocation-depth) - figure out if we can make 'nbdinfo --map' use the new API to automatically select all contexts advertised by the server Eric Blake

I will be following up to this email with four separate threads each addressed to the appropriate single list, with proposed changes to: - the NBD protocol - qemu: both server and client - libnbd: client - nbdkit: server The feature in question adds a new optional NBD_INFO_ packet to the NBD_OPT_GO portion of handshake, adding up to 16 bits of information that the server can advertise to the