[libvirt] [Qemu-devel] NBD TLS support in QEMU
Benoît Canet
benoit.canet at irqsave.net
Thu Sep 4 14:19:17 UTC 2014
The Wednesday 03 Sep 2014 à 17:44:17 (+0100), Stefan Hajnoczi wrote :
> Hi,
> QEMU offers both NBD client and server functionality. The NBD protocol
> runs unencrypted, which is a problem when the client and server
> communicate over an untrusted network.
>
> The particular use case that prompted this mail is storage migration in
> OpenStack. The goal is to encrypt the NBD connection between source and
> destination hosts during storage migration.
I agree this would be usefull.
>
> I think we can integrate TLS into the NBD protocol as an optional flag.
> A quick web search does not reveal existing open source SSL/TLS NBD
> implementations. I do see a VMware NBDSSL protocol but there is no
> specification so I guess it is proprietary.
>
> The NBD protocol starts with a negotiation phase. This would be the
> appropriate place to indicate that TLS will be used. After client and
> server complete TLS setup the connection can continue as normal.
Prenegociating TLS look like we will accidentaly introduce some security hole.
Why not just using a dedicated port and let the TLS handshake happen normaly ?
Best regards
Benoît
>
> Besides QEMU, the userspace NBD tools (http://nbd.sf.net/) can also be
> extended to support TLS. In this case the kernel needs a localhost
> socket and userspace handles TLS.
>
> Thoughts?
>
> Stefan
More information about the libvir-list
mailing list