The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote : > Hi, > QEMU offers both NBD client and server functionality. The NBD protocol > runs unencrypted, which is a problem when the client and server > communicate over an untrusted network. > > The particular use case that prompted this mail is storage migration in > OpenStack. The goal is to encrypt the NBD connection between source and > destination hosts during storage migration. I agree this would be usefull. > > I think we can integrate TLS into the NBD protocol as an optional flag. > A quick web search does not reveal existing open source SSL/TLS NBD > implementations. I do see a VMware NBDSSL protocol but there is no > specification so I guess it is proprietary. > > The NBD protocol starts with a negotiation phase. This would be the > appropriate place to indicate that TLS will be used. After client and > server complete TLS setup the connection can continue as normal. Prenegociating TLS look like we will accidentaly introduce some security hole. Why not just using a dedicated port and let the TLS handshake happen normaly ? Best regards Benoît > > Besides QEMU, the userspace NBD tools (http://nbd.sf.net/) can also be > extended to support TLS. In this case the kernel needs a localhost > socket and userspace handles TLS. > > Thoughts? > > Stefan -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list