Alon Bar-Lev has uploaded a new change for review.
Change subject: BZ#846609: bootstrap: remove dh key generation ......................................................................
BZ#846609: bootstrap: remove dh key generation
Before VDSM used libvirt, it configured qemu with spice TLS with DH key. Using DH key for TLS/SSL is encouraged, as it detach between the encryption and authentication layers.
qemu supports x509-dh-key-file parameter, libvirt does not use this parameter.
qemu supports x509-dir parameter, within it expects to find pre-defined structure of certificate and key material. libvirt does use this parameter. However, qemu only looks for ca, crl, cert, key, so even if we have DH key, it won't be used.
Removing DH key generation.
Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Signed-off-by: Alon Bar-Lev alonbl@redhat.com --- M vds_bootstrap/vds_bootstrap.py M vdsm_reg/deployUtil.py.in M vdsm_reg/vdsm-gen-cert 3 files changed, 3 insertions(+), 11 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/73/7073/1 -- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com
oVirt Jenkins CI Server has posted comments on this change.
Change subject: BZ#846609: bootstrap: remove dh key generation ......................................................................
Patch Set 1:
Build Started http://jenkins.ovirt.info/job/vdsm_unit_tests_by_patch/335/
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
oVirt Jenkins CI Server has posted comments on this change.
Change subject: BZ#846609: bootstrap: remove dh key generation ......................................................................
Patch Set 1:
Build Successful
http://jenkins.ovirt.info/job/vdsm_unit_tests_by_patch/335/ : SUCCESS
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
Yaniv Kaul has posted comments on this change.
Change subject: BZ#846609: bootstrap: remove dh key generation ......................................................................
Patch Set 1:
I'd still just change: deployUtil.py: _logExec([EX_OPENSSL, "dhparam", "-out", dhKey, str(DEF_KEY_LEN)])
to: deployUtil.py: _logExec([EX_OPENSSL, "dhparam", "-out", dhKey, str(1024)])
and be done with it.
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
Alon Bar-Lev has posted comments on this change.
Change subject: BZ#846609: bootstrap: remove dh key generation ......................................................................
Patch Set 1:
and be done with it.
Why waste CPU to generate, disk to store, and future confusion of something that exists but unused?
We will add this if ever need it in future.
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
Doron Fediuck has posted comments on this change.
Change subject: BZ#846609: bootstrap: remove dh key generation ......................................................................
Patch Set 1: Looks good to me, but someone else must approve
If the concept (dropping dh instead of minimizing it) is agreed upon, I'm fine with the implementation.
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Doron Fediuck dfediuck@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
Douglas Schilling Landgraf has posted comments on this change.
Change subject: BZ#846609: bootstrap: remove dh key generation ......................................................................
Patch Set 1: Looks good to me, but someone else must approve
Agree with Doron statement.
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Doron Fediuck dfediuck@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
oVirt Jenkins CI Server has posted comments on this change.
Change subject: bootstrap: remove dh key generation ......................................................................
Patch Set 2:
Build Started http://jenkins.ovirt.info/job/patch_vdms_manager/16/
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Doron Fediuck dfediuck@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
oVirt Jenkins CI Server has posted comments on this change.
Change subject: bootstrap: remove dh key generation ......................................................................
Patch Set 2:
Build Successful
http://jenkins.ovirt.info/job/patch_vdms_manager/16/ : SUCCESS
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Doron Fediuck dfediuck@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
Alon Bar-Lev has posted comments on this change.
Change subject: bootstrap: remove dh key generation ......................................................................
Patch Set 2: Verified
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Doron Fediuck dfediuck@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
Dan Kenigsberg has posted comments on this change.
Change subject: bootstrap: remove dh key generation ......................................................................
Patch Set 2: Looks good to me, approved
Currently it is a pure and exaggerated waste of time.
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Doron Fediuck dfediuck@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
Dan Kenigsberg has submitted this change and it was merged.
Change subject: bootstrap: remove dh key generation ......................................................................
bootstrap: remove dh key generation
Before VDSM used libvirt, it configured qemu with spice TLS with DH key. Using DH key for TLS/SSL is encouraged, as it detach between the encryption and authentication layers.
qemu supports x509-dh-key-file parameter, libvirt does not use this parameter.
qemu supports x509-dir parameter, within it expects to find pre-defined structure of certificate and key material. libvirt does use this parameter. However, qemu only looks for ca, crl, cert, key, so even if we have DH key, it won't be used.
Removing DH key generation.
Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Signed-off-by: Alon Bar-Lev alonbl@redhat.com --- M vds_bootstrap/vds_bootstrap.py M vdsm_reg/deployUtil.py.in M vdsm_reg/vdsm-gen-cert 3 files changed, 3 insertions(+), 11 deletions(-)
Approvals: Alon Bar-Lev: Verified Dan Kenigsberg: Looks good to me, approved
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: merged Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Doron Fediuck dfediuck@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
vdsm-patches@lists.fedorahosted.org