From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40943) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cZEMo-0000i3-T1 for qemu-devel@nongnu.org; Thu, 02 Feb 2017 05:11:54 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cZEIe-0007aB-Lu for qemu-devel@nongnu.org; Thu, 02 Feb 2017 05:07:35 -0500 Received: from mail-wj0-x242.google.com ([2a00:1450:400c:c01::242]:36508) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cZEIe-0007ZE-E6 for qemu-devel@nongnu.org; Thu, 02 Feb 2017 05:07:32 -0500 Received: by mail-wj0-x242.google.com with SMTP id kq3so371662wjc.3 for ; Thu, 02 Feb 2017 02:07:32 -0800 (PST) Date: Thu, 2 Feb 2017 10:07:28 +0000 From: Stefan Hajnoczi Message-ID: <20170202100728.GA20760@stefanha-x1.localdomain> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="fdj2RfSjLxBAspz7" Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] [PATCH v7 RFC] block/vxhs: Initial commit to add Veritas HyperScale VxHS block device support List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Ketan Nilangekar Cc: Buddhi Madhav , ashish mittal , Paolo Bonzini , "Daniel P. Berrange" , Jeff Cody , qemu-devel , Kevin Wolf , Markus Armbruster , Fam Zheng , Ashish Mittal , Abhijit Dey , "Venkatesha M.G." , Nitin Jerath , Gaurav Bhandarkar , Abhishek Kane , Ketan Mahajan , Niranjan Pendharkar , Nirendra Awasthi , Rakesh Ranjan --fdj2RfSjLxBAspz7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Feb 01, 2017 at 11:59:53PM +0000, Ketan Nilangekar wrote: > Patch for secure implementation in libqnio is available for review here: >=20 > https://github.com/VeritasHyperScale/libqnio/pull/12 >=20 > libqnio client initialization now has an option to use X.509 certificates= to authenticate itself to the vxhs server. =20 > Also each client IO request now includes an instance id that is used by t= he vxhs server to authorize the request. > A test client has also been added. > Libqnio.so so is renamed to libvxhs.so. We will rename the repository onc= e the latest patches are merged. > QEMU patch to use the new secure interface will follow shortly. I have left comments on specific lines of code on GitHub. The server should do something based on the client X.509 certificate. Is the code actually verifying certificates on the client side? Right now the code is just going through the motions of SSL but not protecting against man-in-the-middle attacks. I noticed that the code uses OpenSSL. QEMU uses GnuTLS instead of OpenSSL. In practice it's hard to avoid duplication of SSL libraries: GlusterFS and Ceph use OpenSSL and NSS. That means QEMU KVM may drag in GnuTLS, OpenSSL, and NSS! But from a QEMU point of view it would be nicest to use GnuTLS to keep extra library dependencies minimal. Stefan --fdj2RfSjLxBAspz7 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJYkwTgAAoJEJykq7OBq3PIjAIIAIOX8ZlUAAg3uAVYF6E15i69 BeCo9J/ojydXxJ4lh3hANKxVGZTeCRVc+oP9svx8l10aVXM512AX76otxkRTWSCq exVh3u9n4EaaiZUFsnqHDw2VixiZKTkuh3LFJjRqSYJPiX6U1+LAhp8UNtm8hBZX DFS17wQCNQ/n7opBscDPcFu/N/NfH2sXHahBSh0Ye2DdxlYFX6f26vYoYg3gaPps f0SVNxuoFwk3wYCGz7Vnj/cuwzj/ob5Z9BOLUPNpz03P6x0+GajXiB5ViH4jJCqZ AXgZyAIWcS9KeYsqe/BZb1W/WGj0ZiarIkZGZSJjVRRqFeL+NSvlb6rQYvoJWjw= =DZ7B -----END PGP SIGNATURE----- --fdj2RfSjLxBAspz7--