From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33788) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anlP4-00055p-Qw for qemu-devel@nongnu.org; Wed, 06 Apr 2016 07:13:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1anlP1-0001I3-KZ for qemu-devel@nongnu.org; Wed, 06 Apr 2016 07:13:42 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39998) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anlP1-0001Hz-EN for qemu-devel@nongnu.org; Wed, 06 Apr 2016 07:13:39 -0400 Date: Wed, 6 Apr 2016 12:13:35 +0100 From: "Daniel P. Berrange" Message-ID: <20160406111335.GJ23124@redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] Error when attempting to perform TLS NBD connection Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Alex Bligh Cc: qemu-devel@nongnu.org On Tue, Apr 05, 2016 at 09:01:10PM +0100, Alex Bligh wrote: > When I attempt to connect via TLS like this (using today's qemu master): > > ./qemu-img info --object tls-creds-x509,id=tls0,dir=../certs,endpoint=client --image-opts driver=nbd,host=127.0.0.1,port=6666,export=foo,tls-creds=tls0 > > (command line from Daniel over IRC) > > I get the rather opaque error: > > qemu-img: Unable to initialize certificate > > and with the patch I sent through I get the not much less opaque error: > > qemu-img: Unable to initialize certificate: ASN1 parser: Element was not found. > > gdb indicates this is crypto/tlscredsx509.c:399 where gnutls_x509_crt_init(&cert) fails. So the problem turned out to be that the qemu-img program failed to call qcrypto_init(), so gnutls had not had its one-time initialization performed. This doesn't matter for gnutls 3.x but does for anything older than that. I just copied you on a patch to fix this. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|