From patchwork Tue Jan 19 13:52:00 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 569994 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 96FE5140297 for ; Wed, 20 Jan 2016 00:54:18 +1100 (AEDT) Received: from localhost ([::1]:37130 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLWjg-00079D-65 for incoming@patchwork.ozlabs.org; Tue, 19 Jan 2016 08:54:16 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52123) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLWho-0004Yl-4I for qemu-devel@nongnu.org; Tue, 19 Jan 2016 08:52:23 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aLWhm-0000Qu-UL for qemu-devel@nongnu.org; Tue, 19 Jan 2016 08:52:20 -0500 Received: from mx1.redhat.com ([209.132.183.28]:57203) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLWhk-0000QX-SI; Tue, 19 Jan 2016 08:52:16 -0500 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (Postfix) with ESMTPS id 74658A453D; Tue, 19 Jan 2016 13:52:16 +0000 (UTC) Received: from t530wlan.home.berrange.com.com (vpn1-6-80.ams2.redhat.com [10.36.6.80]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u0JDq8Wj019616; Tue, 19 Jan 2016 08:52:14 -0500 From: "Daniel P. Berrange" To: qemu-devel@nongnu.org Date: Tue, 19 Jan 2016 13:52:00 +0000 Message-Id: <1453211520-29417-4-git-send-email-berrange@redhat.com> In-Reply-To: <1453211520-29417-1-git-send-email-berrange@redhat.com> References: <1453211520-29417-1-git-send-email-berrange@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.27 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Paolo Bonzini , Markus Armbruster , qemu-block@nongnu.org Subject: [Qemu-devel] [PATCH v3 3/3] iscsi: add support for getting CHAP password via QCryptoSecret API X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The iSCSI driver currently accepts the CHAP password in plain text as a block driver property. This change adds a new "password-id" property that accepts the ID of a QCryptoSecret instance. $QEMU \ -object secret,id=sec0,filename=/home/berrange/example.pw \ -drive driver=iscsi,url=iscsi://example.com/target-foo/lun1,\ user=dan,password-id=sec0 Signed-off-by: Daniel P. Berrange --- block/iscsi.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/block/iscsi.c b/block/iscsi.c index 3acb052..6a84ae8 100644 --- a/block/iscsi.c +++ b/block/iscsi.c @@ -39,6 +39,7 @@ #include "sysemu/sysemu.h" #include "qmp-commands.h" #include "qapi/qmp/qstring.h" +#include "crypto/secret.h" #include #include @@ -1075,6 +1076,8 @@ static void parse_chap(struct iscsi_context *iscsi, const char *target, QemuOpts *opts; const char *user = NULL; const char *password = NULL; + const char *passwordid; + char *secret = NULL; list = qemu_find_opts("iscsi"); if (!list) { @@ -1094,8 +1097,20 @@ static void parse_chap(struct iscsi_context *iscsi, const char *target, return; } + passwordid = qemu_opt_get(opts, "password-id"); password = qemu_opt_get(opts, "password"); - if (!password) { + if (passwordid && password) { + error_setg(errp, "'password' and 'password-id' properties are " + "mutually exclusive"); + return; + } + if (passwordid) { + secret = qcrypto_secret_lookup_as_utf8(passwordid, errp); + if (!secret) { + return; + } + password = secret; + } else if (!password) { error_setg(errp, "CHAP username specified but no password was given"); return; } @@ -1103,6 +1118,8 @@ static void parse_chap(struct iscsi_context *iscsi, const char *target, if (iscsi_set_initiator_username_pwd(iscsi, user, password)) { error_setg(errp, "Failed to set initiator username and password"); } + + g_free(secret); } static void parse_header_digest(struct iscsi_context *iscsi, const char *target, @@ -1853,6 +1870,11 @@ static QemuOptsList qemu_iscsi_opts = { .type = QEMU_OPT_STRING, .help = "password for CHAP authentication to target", },{ + .name = "password-id", + .type = QEMU_OPT_STRING, + .help = "ID of the secret providing password for CHAP " + "authentication to target", + },{ .name = "header-digest", .type = QEMU_OPT_STRING, .help = "HeaderDigest setting. "