Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-05 Thread Wouter Verhelst
On Fri, Sep 05, 2014 at 12:54:45AM +0200, Benoît Canet wrote: > The Friday 05 Sep 2014 à 00:07:04 (+0200), Wouter Verhelst wrote : > > On Thu, Sep 04, 2014 at 04:19:17PM +0200, Benoît Canet wrote: > > > Prenegociating TLS look like we will accidentaly introduce some security > > > hole. > > I was

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-05 Thread Stefan Hajnoczi
On Fri, Sep 05, 2014 at 09:46:18AM +0100, Hani Benhabiles wrote: > On Wed, Sep 03, 2014 at 05:44:17PM +0100, Stefan Hajnoczi wrote: > Also, so mean of verification is required (otherwise, back to point 0 being > vulnerable to sslstrip style attacks) either that the server's cert is signed > with a

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-05 Thread Stefan Hajnoczi
On Fri, Sep 05, 2014 at 12:02:18AM +0200, Wouter Verhelst wrote: > [Cc: to nbd-general list added] > > On Wed, Sep 03, 2014 at 05:44:17PM +0100, Stefan Hajnoczi wrote: > > Besides QEMU, the userspace NBD tools (http://nbd.sf.net/) can also be > > extended to support TLS. In this case the kernel n

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-05 Thread Stefan Hajnoczi
On Fri, Sep 05, 2014 at 12:54:45AM +0200, Benoît Canet wrote: > The Friday 05 Sep 2014 à 00:07:04 (+0200), Wouter Verhelst wrote : > > On Thu, Sep 04, 2014 at 04:19:17PM +0200, Benoît Canet wrote: > > > The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : > > > > Hi, > > > > QEMU o

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-04 Thread Benoît Canet
The Friday 05 Sep 2014 à 00:07:04 (+0200), Wouter Verhelst wrote : > On Thu, Sep 04, 2014 at 04:19:17PM +0200, Benoît Canet wrote: > > The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : > > > Hi, > > > QEMU offers both NBD client and server functionality. The NBD protocol > > >

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-04 Thread Wouter Verhelst
On Thu, Sep 04, 2014 at 04:19:17PM +0200, Benoît Canet wrote: > The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : > > Hi, > > QEMU offers both NBD client and server functionality. The NBD protocol > > runs unencrypted, which is a problem when the client and server > > communica

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-04 Thread John Snow
On 09/04/2014 10:34 AM, Daniel P. Berrange wrote: On Thu, Sep 04, 2014 at 04:19:17PM +0200, Benoît Canet wrote: The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : Hi, QEMU offers both NBD client and server functionality. The NBD protocol runs unencrypted, which is a proble

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-04 Thread Stefan Hajnoczi
On Thu, Sep 04, 2014 at 05:04:06PM +0200, Benoît Canet wrote: > The Thursday 04 Sep 2014 à 15:34:59 (+0100), Daniel P. Berrange wrote : > > On Thu, Sep 04, 2014 at 04:19:17PM +0200, Benoît Canet wrote: > > > The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : > > > > Hi, > > > > Q

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-04 Thread Benoît Canet
The Thursday 04 Sep 2014 à 15:34:59 (+0100), Daniel P. Berrange wrote : > On Thu, Sep 04, 2014 at 04:19:17PM +0200, Benoît Canet wrote: > > The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : > > > Hi, > > > QEMU offers both NBD client and server functionality. The NBD protocol >

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-04 Thread Daniel P. Berrange
On Thu, Sep 04, 2014 at 04:19:17PM +0200, Benoît Canet wrote: > The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : > > Hi, > > QEMU offers both NBD client and server functionality. The NBD protocol > > runs unencrypted, which is a problem when the client and server > > communica

Re: [libvirt] [Qemu-devel] NBD TLS support in QEMU

2014-09-04 Thread Benoît Canet
The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : > Hi, > QEMU offers both NBD client and server functionality. The NBD protocol > runs unencrypted, which is a problem when the client and server > communicate over an untrusted network. > > The particular use case that prompted