Re: [Nbd] [Qemu-devel] spec, RFC: TLS support for NBD
- To: Florian Weimer <fweimer@...696...>
- Cc: "Daniel P. Berrange" <berrange@...696...>, libvir-list@...696..., mprivozn@...696..., nbd-general@...72..., Markus Armbruster <armbru@...696...>, qemu-devel@...530..., Stefan Hajnoczi <stefanha@...696...>, Wouter Verhelst <w@...112...>, Paolo Bonzini <pbonzini@...696...>, Max Reitz <mreitz@...696...>
- Subject: Re: [Nbd] [Qemu-devel] spec, RFC: TLS support for NBD
- From: "Richard W.M. Jones" <rjones@...696...>
- Date: Mon, 20 Oct 2014 13:48:26 +0100
- Message-id: <20141020124826.GH1349@...696...>
- In-reply-to: <5444F87B.7010708@...696...>
- References: <20140905132608.GB26974@...3...> <20141001202326.GA2533@...3...> <20141002110516.GG13032@...696...> <542D36E8.2010705@...696...> <20141017220323.GC31287@...3...> <20141018063322.GC1349@...696...> <20141020075814.GB19687@...696...> <20141020095621.GA28515@...1390...> <8738ajq7qo.fsf@...1802...> <5444F87B.7010708@...696...>
On Mon, Oct 20, 2014 at 01:56:43PM +0200, Florian Weimer wrote:
> On 10/20/2014 01:51 PM, Markus Armbruster wrote:
> >Furthermore, STARTTLS is vulnerable to active attacks: if you can get
> >between the peers, you can make them fall back to unencrypted silently.
> >How do you plan to guard against that?
>
> The usual way to deal with this is to use different syntax for
> TLS-enabled and non-TLS addresses (e.g., https:// and http://).
> With a TLS address, the client must enforce that only TLS-enabled
> connections are possible. STARTTLS isn't the problem here, it's
> just an accident of history that many STARTTLS client
> implementations do not require a TLS handshake before proceeding.
>
> I cannot comment on whether the proposed STARTTLS command is at the
> correct stage of the NBD protocol. If there is a protocol
> description for NBD, I can have a look.
Two actually :-) Both are covered here:
http://sourceforge.net/p/nbd/code/ci/master/tree/doc/proto.txt
I believe that the proposed changes only cover the new style
protocol.
There's no common syntax for nbd URLs that I'm aware of. At least,
both qemu & guestfish have nbd:... strings that they can parse, but
both have a completely different syntax. But we could still have a
client-side indication (flag or nbds:..) to say that we want to force
TLS.
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-top is 'top' for virtual machines. Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://people.redhat.com/~rjones/virt-top
Reply to: