daemon: add tcp_min_ssf option

Add an option to allow the admin to requet a higher minimum SSF
for connections than the built-in default.

The current default is 56 (single DES equivalent, to support
old kerberos) and will be raised to 112 in the future.

https://bugzilla.redhat.com/show_bug.cgi?id=1431589

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

diff --git a/src/remote/libvirtd.aug.in b/src/remote/libvirtd.aug.in
index 61ea8067b96ff897eb4d474ab82bdc5e84291321..d744548f4126da99fd92e6a1fc095fe20dfdb974 100644 (file)
--- a/src/remote/libvirtd.aug.in
+++ b/src/remote/libvirtd.aug.in
@@ -43,6 +43,7 @@ module @DAEMON_NAME_UC@ =
 @CUT_ENABLE_IP@
                             | str_entry "auth_tcp"
                             | str_entry "auth_tls"
+                            | int_entry "tcp_min_ssf"
 
    let certificate_entry = str_entry "key_file"
                          | str_entry "cert_file"

diff --git a/src/remote/libvirtd.conf.in b/src/remote/libvirtd.conf.in
index ad049f636bb23e9cd01468641b5a3ebd322b6a07..8e709856aacb3e340ad759b53972891bb866a94e 100644 (file)
--- a/src/remote/libvirtd.conf.in
+++ b/src/remote/libvirtd.conf.in
@@ -197,6 +197,14 @@
 # It is possible to make use of any SASL authentication
 # mechanism as well, by using 'sasl' for this option
 #auth_tls = "none"
+
+# Enforce a minimum SSF value for TCP sockets
+#
+# The default minimum is currently 56 (single-DES) which will
+# be raised to 112 in the future.
+#
+# This option can be used to set values higher than 112
+#tcp_min_ssf = 112
 @END@
 
 

diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c
index b534cb3e373a59069a013110590b5b83fd8a9f75..de43a54c2e75b8ee5259bc04420e3e49368e38a9 100644 (file)
--- a/src/remote/remote_daemon.c
+++ b/src/remote/remote_daemon.c
@@ -210,6 +210,9 @@ daemonSetupNetworking(virNetServer *srv,
     int unix_sock_ro_mask = 0;
     int unix_sock_rw_mask = 0;
     int unix_sock_adm_mask = 0;
+#if WITH_SASL
+    unsigned int tcp_min_ssf = 0;
+#endif /* !WITH_SASL */
     g_autoptr(virSystemdActivation) act = NULL;
     virSystemdActivationMap actmap[] = {
         { .name = DAEMON_NAME ".socket", .family = AF_UNIX, .path = sock_path },
@@ -403,10 +406,13 @@ daemonSetupNetworking(virNetServer *srv,
         return -1;
 
 #if WITH_SASL
+# if WITH_IP
+    tcp_min_ssf = config->tcp_min_ssf;
+# endif
     if (virNetServerNeedsAuth(srv, REMOTE_AUTH_SASL) &&
         !(saslCtxt = virNetSASLContextNewServer(
               (const char *const*)config->sasl_allowed_username_list,
-              56)))
+              tcp_min_ssf)))
         return -1;
 #endif
 

diff --git a/src/remote/remote_daemon_config.c b/src/remote/remote_daemon_config.c
index a47ec1450867bfaa2f2756d6534e6160ed45ea64..a9961013f2d10b6f63e9de2a13531098b83ec9dc 100644 (file)
--- a/src/remote/remote_daemon_config.c
+++ b/src/remote/remote_daemon_config.c
@@ -134,6 +134,10 @@ daemonConfigNew(bool privileged G_GNUC_UNUSED)
     data->auth_tls = REMOTE_AUTH_NONE;
 #endif /* ! WITH_IP */
 
+#if WITH_IP
+    data->tcp_min_ssf = 56; /* good enough for kerberos */
+#endif
+
     data->min_workers = 5;
     data->max_workers = 20;
     data->max_clients = 5000;
@@ -298,6 +302,17 @@ daemonConfigLoadOptions(struct daemonConfig *data,
 
     if (virConfGetValueString(conf, "tls_priority", &data->tls_priority) < 0)
         return -1;
+
+    if (virConfGetValueUInt(conf, "tcp_min_ssf", &data->tcp_min_ssf) < 0)
+        return -1;
+
+    if (data->tcp_min_ssf < SSF_WARNING_LEVEL) {
+        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                       _("minimum SSF levels lower than %d are not supported"),
+                       SSF_WARNING_LEVEL);
+        return -1;
+    }
+
 #endif /* ! WITH_IP */
 
     if (virConfGetValueStringList(conf, "sasl_allowed_username_list", false,

diff --git a/src/remote/remote_daemon_config.h b/src/remote/remote_daemon_config.h
index 9cad9da734e5b2e7de98871e90b6e213d6fc5643..47839271d315e2db9dab9b855a57346ffbca843b 100644 (file)
--- a/src/remote/remote_daemon_config.h
+++ b/src/remote/remote_daemon_config.h
@@ -56,6 +56,7 @@ struct daemonConfig {
     bool tls_no_sanity_certificate;
     char **tls_allowed_dn_list;
     char *tls_priority;
+    unsigned int tcp_min_ssf;
 
     char *key_file;
     char *cert_file;

diff --git a/src/remote/test_libvirtd.aug.in b/src/remote/test_libvirtd.aug.in
index 56c4487a0194a609cfe8021f027042255fa7918a..c27680e1306e791f4b9e7f455854463d0a026e67 100644 (file)
--- a/src/remote/test_libvirtd.aug.in
+++ b/src/remote/test_libvirtd.aug.in
@@ -19,6 +19,7 @@ module Test_@DAEMON_NAME@ =
 @CUT_ENABLE_IP@
         { "auth_tcp" = "sasl" }
         { "auth_tls" = "none" }
+        { "tcp_min_ssf" = "112" }
 @END@
         { "access_drivers"
              { "1" = "polkit" }