diff options
| author | Daniel P. Berrangé | 2022-03-04 20:35:59 +0100 |
|---|---|---|
| committer | Eric Blake | 2022-03-07 22:58:42 +0100 |
| commit | d41997e465c533f3a29e0d0bb52cfcad696e2b2d (patch) | |
| tree | 220816944d36b23a0c4dc5c4b5ccdc0c8e555225 /include | |
| parent | Merge remote-tracking branch 'remotes/hreitz-gitlab/tags/pull-block-2022-03-0... (diff) | |
| download | qemu-d41997e465c533f3a29e0d0bb52cfcad696e2b2d.tar.gz qemu-d41997e465c533f3a29e0d0bb52cfcad696e2b2d.tar.xz qemu-d41997e465c533f3a29e0d0bb52cfcad696e2b2d.zip | |
crypto: mandate a hostname when checking x509 creds on a client
Currently the TLS session object assumes that the caller will always
provide a hostname when using x509 creds on a client endpoint. This
relies on the caller to detect and report an error if the user has
configured QEMU with x509 credentials on a UNIX socket. The migration
code has such a check, but it is too broad, reporting an error when
the user has configured QEMU with PSK credentials on a UNIX socket,
where hostnames are irrelevant.
Putting the check into the TLS session object credentials validation
code ensures we report errors in only the scenario that matters.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20220304193610.3293146-2-berrange@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions