From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36891) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aopcY-0004BP-2D for qemu-devel@nongnu.org; Sat, 09 Apr 2016 05:56:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aopcT-0000wF-0U for qemu-devel@nongnu.org; Sat, 09 Apr 2016 05:56:01 -0400 Received: from barbershop.grep.be ([89.106.240.122]:40994) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aopcS-0000w6-Qf for qemu-devel@nongnu.org; Sat, 09 Apr 2016 05:55:56 -0400 Date: Sat, 9 Apr 2016 11:55:45 +0200 From: Wouter Verhelst Message-ID: <20160409095545.GG19023@grep.be> References: <1460028959-59091-1-git-send-email-alex@alex.org.uk> <57066F3B.7010500@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <57066F3B.7010500@redhat.com> Subject: Re: [Qemu-devel] [Nbd] [PATCH] Improve documentation for TLS List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: Alex Bligh , "nbd-general@lists.sourceforge.net" , "Daniel P. Berrange" , "qemu-devel@nongnu.org" On Thu, Apr 07, 2016 at 08:31:23AM -0600, Eric Blake wrote: > > +The FORCEDTLS mode of operation has an implementation problem in > > +that the client MAY legally simply send a `NBD_OPT_EXPORT_NAME` > > +to enter transmission mode without previously sending any options. > > +Therefore, if a server uses FORCEDTLS, it SHOULD implement the > > +INFO extension. > > I'd go one step further: > > If a server uses FORCEDTLS, it MUST implement the > NBD_FLAG_FIXED_NEWSTYLE flag, and SHOULD implement the INFO extension. Yes. > That way, a client can send ANY option to learn if TLS is required (even > an option that the server does not recognize); where NBD_OPT_INFO and > NBD_OPT_LIST are probably the two most useful options, but where ANY > option works. A server with TLS but not FIXED_NEWSTYLE is pointless Actually, such a server is technically impossible ;-) > (since TLS was introduced at the same time as fixed newstyle, Eh. I don't know where you got that idea, but that's absolutely not true. Fixed newstyle was introduced five years ago, TLS was introduced last year or so. > we can reasonably require, rather than just suggest, that both things > be implemented at once to be a compliant FORCEDTLS server). We have to make fixed newstyle a dependency of any form of tls, but nothing more seems appropriate. ("fixed newstyle" is necessary for *anything* that is not NBD_OPT_EXPORT_NAME) [...] -- < ron> I mean, the main *practical* problem with C++, is there's like a dozen people in the world who think they really understand all of its rules, and pretty much all of them are just lying to themselves too. -- #debian-devel, OFTC, 2016-02-12