From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35949) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1atZem-0002Af-D2 for qemu-devel@nongnu.org; Fri, 22 Apr 2016 07:53:57 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1atZel-0003zB-BR for qemu-devel@nongnu.org; Fri, 22 Apr 2016 07:53:56 -0400 Date: Fri, 22 Apr 2016 13:53:47 +0200 From: Kevin Wolf Message-ID: <20160422115347.GE4237@noname.redhat.com> References: <1461320695-31372-1-git-send-email-berrange@redhat.com> <1461320695-31372-2-git-send-email-berrange@redhat.com> <20160422105928.GC4237@noname.redhat.com> <571A0766.9030007@kamp.de> <20160422114340.GD17478@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160422114340.GD17478@redhat.com> Subject: Re: [Qemu-devel] [PATCH for-2.6] block: add an 'iscsi-id' value to match -drive with -iscsi opts List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" Cc: Peter Lieven , qemu-devel@nongnu.org, qemu-block@nongnu.org, Ronnie Sahlberg , Paolo Bonzini , John Ferlan , Pino Toscano Am 22.04.2016 um 13:43 hat Daniel P. Berrange geschrieben: > On Fri, Apr 22, 2016 at 01:13:42PM +0200, Peter Lieven wrote: > > Am 22.04.2016 um 12:59 schrieb Kevin Wolf: > > > Am 22.04.2016 um 12:24 hat Daniel P. Berrange geschrieben: > > >> The iSCSI block driver has ability to lookup various options, in > > >> particular authentication info, specified by the separate -iscsi > > >> argument. It currently uses the iSCSI IQN as the ID value for this > > >> lookup, however, this does not work for common iSCSI IQNs as they > > >> contain characters such as ':' which are invalid for use as IDs. > > >> > > >> This adds an optional 'iscsi-id' parameter to the iSCSI block > > >> driver to allow an explicit ID string to be used to reference > > >> the -iscsi arg. For example > > >> > > >> $QEMU \ > > >> -iscsi id=my_initiator,user=fred,password-secret=sec0 \ > > >> -drive driver=iscsi,iscsi-id=my_initiator,file=iscsi://somehost/iqn/1 > > >> > > >> Signed-off-by: Daniel P. Berrange > > > I would consider this a new feature rather than a fix appropriate for > > > -rc4. > > > > +1 > > > > Its rather late and this might have some side effects that are not obvious. > > If you need to specify different credentials for different targets you can stil > > supply them in the iscsi URL: > > > > iscsi://username:password@host/iqn/0 > > Use of that syntax is why CVE-2015-5160 exists because it exposes the > password to any other process on the host which can see the QEMU argv. > -iscsi supports the new password-secret arg that lets us avoid that > flaw. -iscsi is a weird thing anyway. We should do things the usual way, with a proper BlockdevOptionsIscsi QAPI structure. Introducing a new API in 2.6 when we know we'll deprecate it again in 2.7 doesn't seem to make that much sense. Plus, it's -rc4 now. The problem isn't a crash or a regression. It merely means that you might need to wait for another release before you can use iscsi. Pretty much the definition of a new feature. Kevin