Re: [libvirt] NBD TLS support in QEMU

2014-10-09 Thread Paolo Bonzini
Il 08/10/2014 20:16, Wouter Verhelst ha scritto: @@ -242,10 +242,13 @@ Option types * NBD_OPT_EXPORT_NAME (1) Choose the export which the client would like to use, and end option haggling. Data: name of the export, free-form UTF8 text (subject to limitations by server

Re: [libvirt] NBD TLS support in QEMU

2014-10-08 Thread Wouter Verhelst
On Thu, Oct 02, 2014 at 03:50:57PM +0200, Wouter Verhelst wrote: On Thu, Oct 02, 2014 at 01:00:04PM +0200, Paolo Bonzini wrote: Il 01/10/2014 22:23, Wouter Verhelst ha scritto: Hi, On Fri, Sep 05, 2014 at 03:26:09PM +0200, Wouter Verhelst wrote: Tunneling the entire protocol inside

Re: [libvirt] NBD TLS support in QEMU

2014-10-02 Thread Paolo Bonzini
Il 01/10/2014 22:23, Wouter Verhelst ha scritto: Hi, On Fri, Sep 05, 2014 at 03:26:09PM +0200, Wouter Verhelst wrote: Tunneling the entire protocol inside an SSL connection doesn't fix that; if an attacker is able to hijack your TCP connections and change flags, then this attacker is also

Re: [libvirt] NBD TLS support in QEMU

2014-10-02 Thread Daniel P. Berrange
On Wed, Oct 01, 2014 at 10:23:26PM +0200, Wouter Verhelst wrote: Hi, On Fri, Sep 05, 2014 at 03:26:09PM +0200, Wouter Verhelst wrote: Tunneling the entire protocol inside an SSL connection doesn't fix that; if an attacker is able to hijack your TCP connections and change flags, then this

Re: [libvirt] NBD TLS support in QEMU

2014-10-02 Thread Paolo Bonzini
Il 02/10/2014 13:05, Daniel P. Berrange ha scritto: On Wed, Oct 01, 2014 at 10:23:26PM +0200, Wouter Verhelst wrote: Hi, On Fri, Sep 05, 2014 at 03:26:09PM +0200, Wouter Verhelst wrote: Tunneling the entire protocol inside an SSL connection doesn't fix that; if an attacker is able to hijack

Re: [libvirt] NBD TLS support in QEMU

2014-10-02 Thread Wouter Verhelst
On Thu, Oct 02, 2014 at 01:00:04PM +0200, Paolo Bonzini wrote: Il 01/10/2014 22:23, Wouter Verhelst ha scritto: Hi, On Fri, Sep 05, 2014 at 03:26:09PM +0200, Wouter Verhelst wrote: Tunneling the entire protocol inside an SSL connection doesn't fix that; if an attacker is able to hijack

Re: [libvirt] NBD TLS support in QEMU

2014-10-01 Thread Wouter Verhelst
Hi, On Fri, Sep 05, 2014 at 03:26:09PM +0200, Wouter Verhelst wrote: Tunneling the entire protocol inside an SSL connection doesn't fix that; if an attacker is able to hijack your TCP connections and change flags, then this attacker is also able to hijack your TCP connection and redirect it

Re: [libvirt] NBD TLS support in QEMU

2014-09-05 Thread Michal Privoznik
On 03.09.2014 18:44, Stefan Hajnoczi wrote: Hi, QEMU offers both NBD client and server functionality. The NBD protocol runs unencrypted, which is a problem when the client and server communicate over an untrusted network. This is not problem for NBD only, but for the rest of data that qemu

Re: [libvirt] NBD TLS support in QEMU

2014-09-05 Thread Daniel P. Berrange
On Fri, Sep 05, 2014 at 08:23:17AM +0200, Michal Privoznik wrote: On 03.09.2014 18:44, Stefan Hajnoczi wrote: Hi, QEMU offers both NBD client and server functionality. The NBD protocol runs unencrypted, which is a problem when the client and server communicate over an untrusted network.

Re: [libvirt] NBD TLS support in QEMU

2014-09-05 Thread Daniel P. Berrange
On Fri, Sep 05, 2014 at 12:02:18AM +0200, Wouter Verhelst wrote: [Cc: to nbd-general list added] On Wed, Sep 03, 2014 at 05:44:17PM +0100, Stefan Hajnoczi wrote: Hi, QEMU offers both NBD client and server functionality. The NBD protocol runs unencrypted, which is a problem when the

Re: [libvirt] NBD TLS support in QEMU

2014-09-05 Thread Wouter Verhelst
On Fri, Sep 05, 2014 at 09:46:18AM +0100, Hani Benhabiles wrote: On Wed, Sep 03, 2014 at 05:44:17PM +0100, Stefan Hajnoczi wrote: Hi, QEMU offers both NBD client and server functionality. The NBD protocol runs unencrypted, which is a problem when the client and server communicate over an

Re: [libvirt] NBD TLS support in QEMU

2014-09-05 Thread Hani Benhabiles
On Wed, Sep 03, 2014 at 05:44:17PM +0100, Stefan Hajnoczi wrote: Hi, QEMU offers both NBD client and server functionality. The NBD protocol runs unencrypted, which is a problem when the client and server communicate over an untrusted network. The particular use case that prompted this mail

Re: [libvirt] NBD TLS support in QEMU

2014-09-05 Thread Wouter Verhelst
On Fri, Sep 05, 2014 at 09:13:26AM +0100, Daniel P. Berrange wrote: On Fri, Sep 05, 2014 at 12:02:18AM +0200, Wouter Verhelst wrote: [Cc: to nbd-general list added] On Wed, Sep 03, 2014 at 05:44:17PM +0100, Stefan Hajnoczi wrote: Hi, QEMU offers both NBD client and server

Re: [libvirt] NBD TLS support in QEMU

2014-09-04 Thread Wouter Verhelst
[Cc: to nbd-general list added] On Wed, Sep 03, 2014 at 05:44:17PM +0100, Stefan Hajnoczi wrote: Hi, QEMU offers both NBD client and server functionality. The NBD protocol runs unencrypted, which is a problem when the client and server communicate over an untrusted network. The particular

[libvirt] NBD TLS support in QEMU

2014-09-03 Thread Stefan Hajnoczi
Hi, QEMU offers both NBD client and server functionality. The NBD protocol runs unencrypted, which is a problem when the client and server communicate over an untrusted network. The particular use case that prompted this mail is storage migration in OpenStack. The goal is to encrypt the NBD