On 2/2/17, 2:07 AM, "Stefan Hajnoczi" <stefa...@gmail.com> wrote:
On Wed, Feb 01, 2017 at 11:59:53PM +0000, Ketan Nilangekar wrote:
> Patch for secure implementation in libqnio is available for review here:
>
> https://github.com/VeritasHyperScale/libqnio/pull/12
>
> libqnio client initialization now has an option to use X.509 certificates
to authenticate itself to the vxhs server.
> Also each client IO request now includes an instance id that is used by
the vxhs server to authorize the request.
> A test client has also been added.
> Libqnio.so so is renamed to libvxhs.so. We will rename the repository
once the latest patches are merged.
> QEMU patch to use the new secure interface will follow shortly.
I have left comments on specific lines of code on GitHub.
[Ketan]
I have replied to your comments and will be uploading a patch shortly to cover
some fixes.
The server should do something based on the client X.509 certificate.
Is the code actually verifying certificates on the client side?
Right now the code is just going through the motions of SSL but not
protecting against man-in-the-middle attacks.
[Ketan]
The VxHS server implementation will be verifying the client certificates.
The libqnio server implementation is just a sample to verify the client
functionality.
VxHS does not use the libqnio server implementation.
I noticed that the code uses OpenSSL. QEMU uses GnuTLS instead of
OpenSSL. In practice it's hard to avoid duplication of SSL libraries:
GlusterFS and Ceph use OpenSSL and NSS. That means QEMU KVM may drag in
GnuTLS, OpenSSL, and NSS! But from a QEMU point of view it would be
nicest to use GnuTLS to keep extra library dependencies minimal.
[Ketan]
If GlusterFS is already using OpenSSL then libqnio is not introducing anything
new here.
From a licensing perspective there seems to be a way of adding a “GPL linking
exception” in this case.
