Change in vdsm[master]: ssl: enable tlsv1.2 support
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has posted comments on this change.
Change subject: ssl: enable tlsv1.2 support
......................................................................
Patch Set 27: Code-Review-1
(3 comments)
https://gerrit.ovirt.org/#/c/72284/27//COMMIT_MSG
Commit Message:
Line 8:
Line 9: We support all three tlsv1, tlsv1.1 and tlsv1.2 protocols or only
Line 10: tlsv1.2. We need to make sure that user is aware of the choices. When
Line 11: used tlsv1.2 only the client side uses all three protocols to make sure
Line 12: that we are backward compatible with older vdsms.
why? by default, we are backward compat. if a user bothered to set tlsv1.2, we can respect his choice and accept only it.
p.s. I am not sure this is the case in the code; it seems that your client side uses a single porotolc (1.2).
Line 13:
Line 14: During testing I noticed that sslv3 is still enabled on centos7 so we
Line 15: need to disable it manually. It is not possible to use ssl.PROTOCOL_TLS
Line 16: because it is not available for centos7.
Line 10: tlsv1.2. We need to make sure that user is aware of the choices. When
Line 11: used tlsv1.2 only the client side uses all three protocols to make sure
Line 12: that we are backward compatible with older vdsms.
Line 13:
Line 14: During testing I noticed that sslv3 is still enabled on centos7 so we
sorry for realizing this so late in the game, but I think that this patch should be improved.
One thing that could have helped me could have been a split of this patch. Making sure that sslv23 means the same on all platforms merits its own patch.
Line 15: need to disable it manually. It is not possible to use ssl.PROTOCOL_TLS
Line 16: because it is not available for centos7.
Line 17:
Line 18: Bug-Url: https://bugzilla.redhat.com/1412552
https://gerrit.ovirt.org/#/c/72284/27/lib/vdsm/config.py.in
File lib/vdsm/config.py.in:
PS27, Line 227: tlsv1.2
I think this is not what the user wants to happen once tlsv1.3 is out: most users would like to allow the new protocol, and even prefer it.
I think that what we need is to have an *exclude* list here, such as
ssl_protocol=OP_NO_TLSv1,OP_NO_TLSv1_1
--
To view, visit https://gerrit.ovirt.org/72284
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I8cc83d8cc08349a0ca47ed7d021bb3fc6d1408a6
Gerrit-PatchSet: 27
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Piotr Kliczewski <piotr.kliczewski(a)gmail.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Irit Goihman <igoihman(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Martin Peřina <mperina(a)redhat.com>
Gerrit-Reviewer: Michal Skrivanek <michal.skrivanek(a)redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski(a)gmail.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
Gerrit-HasComments: Yes
7 years
Change in vdsm[master]: vm: create a vnic with vhostuser backend
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has posted comments on this change.
Change subject: vm: create a vnic with vhostuser backend
......................................................................
Patch Set 31: Code-Review-1
(1 comment)
https://gerrit.ovirt.org/#/c/74327/31/lib/vdsm/virt/vmdevices/network.py
File lib/vdsm/virt/vmdevices/network.py:
Line 303: detach_detachable(self.hostdev)
Line 304: else:
Line 305: bridge_info = supervdsm.getProxy().ovs_bridge(self.network)
Line 306: if bridge_info and bridge_info['dpdk_enabled']:
Line 307: self._is_vhostuser = True
this is not called during recovery flow. We should either persist this in conf, or pass it to __init__ during recovery, or recalculate during deardown+getXML.
Line 308: self._create_vhost_port(bridge_info['name'])
Line 309:
Line 310: def teardown(self):
Line 311: if self.is_hostdevice:
--
To view, visit https://gerrit.ovirt.org/74327
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie81cf52f17ffe01713dd6502d68c4b17c64e5335
Gerrit-PatchSet: 31
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Irit Goihman <igoihman(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Edward Haas <edwardh(a)redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Irit Goihman <igoihman(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Martin Peřina <mperina(a)redhat.com>
Gerrit-Reviewer: Martin Polednik <mpolednik(a)redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: Petr Horáček <phoracek(a)redhat.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
Gerrit-HasComments: Yes
7 years
Change in vdsm[master]: spec: Handle VDSM services restart on upgrade to posttrans
by Code Review
From Yaniv Bronhaim <ybronhei(a)redhat.com>:
Yaniv Bronhaim has posted comments on this change.
Change subject: spec: Handle VDSM services restart on upgrade to posttrans
......................................................................
Patch Set 1:
(1 comment)
https://gerrit.ovirt.org/#/c/77785/1//COMMIT_MSG
Commit Message:
PS1, Line 19: twice
> Can we hack it somehow not to have it?
not much. if we avoid running the new script we won't have edi's logic that restart the network-vdsm service - which was the initial reason for updating this area of the code.
in the other hand, we can change old versions which already have this code in their postun.
I think its alright to run it twice only after upgrade - vdsmd restart should not cause libvirtd restart, and the time between the restarts is quite short. I don't see risks.. same if we restarted libvirt and we'll run it twice in short time - it won't really matter (guess between the postun run to the posttrans not much is passed)
--
To view, visit https://gerrit.ovirt.org/77785
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I16793ff6ca1fcf596f57b459fa4ed348a879b104
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Edward Haas <edwardh(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Edward Haas <edwardh(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski(a)gmail.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
Gerrit-HasComments: Yes
7 years
Change in vdsm[master]: vm: create a vnic with vhostuser backend
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has posted comments on this change.
Change subject: vm: create a vnic with vhostuser backend
......................................................................
Patch Set 31: Code-Review+1
--
To view, visit https://gerrit.ovirt.org/74327
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie81cf52f17ffe01713dd6502d68c4b17c64e5335
Gerrit-PatchSet: 31
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Irit Goihman <igoihman(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Edward Haas <edwardh(a)redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Irit Goihman <igoihman(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Martin Peřina <mperina(a)redhat.com>
Gerrit-Reviewer: Martin Polednik <mpolednik(a)redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: Petr Horáček <phoracek(a)redhat.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
Gerrit-HasComments: No
7 years
Change in vdsm[master]: Revert "virt: Switch to persistent domains"
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has posted comments on this change.
Change subject: Revert "virt: Switch to persistent domains"
......................................................................
Patch Set 1: Code-Review+2
how ironic, one of the reasons for persistent domains was the expected better support from libvirt.
--
To view, visit https://gerrit.ovirt.org/77845
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: Idb4fef617bb2c9fd9dbffb13a046f3840c41ce2f
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Michal Skrivanek <michal.skrivanek(a)redhat.com>
Gerrit-Reviewer: Milan Zamazal <mzamazal(a)redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
Gerrit-HasComments: No
7 years
Change in vdsm[master]: network: translate libnl str output only if not None
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has submitted this change and it was merged.
Change subject: network: translate libnl str output only if not None
......................................................................
network: translate libnl str output only if not None
Change-Id: Iec234aeaf5f2c7089544c44bc2a3602e1c97c0ed
Signed-off-by: Petr Horacek <phoracek(a)redhat.com>
---
M lib/vdsm/network/netlink/libnl.py
1 file changed, 5 insertions(+), 11 deletions(-)
Approvals:
Jenkins CI: Passed CI tests
Dan Kenigsberg: Looks good to me, approved
Edward Haas: Verified
--
To view, visit https://gerrit.ovirt.org/77901
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Iec234aeaf5f2c7089544c44bc2a3602e1c97c0ed
Gerrit-PatchSet: 3
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Petr Horáček <phoracek(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Edward Haas <edwardh(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Petr Horacek <phoracek(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
7 years
Change in vdsm[master]: network: translate libnl str output only if not None
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has posted comments on this change.
Change subject: network: translate libnl str output only if not None
......................................................................
Patch Set 2: Code-Review+2
--
To view, visit https://gerrit.ovirt.org/77901
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: Iec234aeaf5f2c7089544c44bc2a3602e1c97c0ed
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Petr Horáček <phoracek(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Edward Haas <edwardh(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Petr Horacek <phoracek(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
Gerrit-HasComments: No
7 years
Change in vdsm[master]: Revert "multipath: Do not fail I/O after short outage"
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has submitted this change and it was merged.
Change subject: Revert "multipath: Do not fail I/O after short outage"
......................................................................
Revert "multipath: Do not fail I/O after short outage"
This reverts commit c43169e3dea98fbc3469ae149264f344bd04bba0.
Multipath segfaults now when using "no_path_retry 4" in the special
all_devs section. We will have to wait for a fix before we can use this
configuration.
Change-Id: If0f2564ca125cd93e8d1fd4c72cb65d655e202e1
Relates-to: https://bugzilla.redhat.com/1459370
Signed-off-by: Nir Soffer <nsoffer(a)redhat.com>
---
M lib/vdsm/tool/configurators/multipath.py
1 file changed, 7 insertions(+), 21 deletions(-)
Approvals:
Nir Soffer: Verified
Jenkins CI: Passed CI tests
Dan Kenigsberg: Looks good to me, approved
--
To view, visit https://gerrit.ovirt.org/77902
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: If0f2564ca125cd93e8d1fd4c72cb65d655e202e1
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
7 years
Change in vdsm[master]: Revert "multipath: Do not fail I/O after short outage"
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has posted comments on this change.
Change subject: Revert "multipath: Do not fail I/O after short outage"
......................................................................
Patch Set 1: Code-Review+2
ost is happy with this. taken.
--
To view, visit https://gerrit.ovirt.org/77902
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: If0f2564ca125cd93e8d1fd4c72cb65d655e202e1
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Nir Soffer <nsoffer(a)redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
Gerrit-HasComments: No
7 years
Change in vdsm[master]: compat: Move compat module to common
by Code Review
From Dan Kenigsberg <danken(a)redhat.com>:
Dan Kenigsberg has submitted this change and it was merged.
Change subject: compat: Move compat module to common
......................................................................
compat: Move compat module to common
compat fits vdsm.common as it has no dependencies on inner vdsm
packages.
Change-Id: I5b3693cac5ed36d2a9bd89d59bf0fd41049e57aa
Signed-off-by: Edward Haas <edwardh(a)redhat.com>
---
M lib/vdsm/Makefile.am
M lib/vdsm/commands.py
R lib/vdsm/common/compat.py
M lib/vdsm/metrics/hawkular.py
M lib/vdsm/network/cmd.py
M lib/vdsm/qemuimg.py
M lib/vdsm/storage/check.py
M lib/vdsm/storage/compat.py
M lib/vdsm/storage/operation.py
M lib/vdsm/utils.py
M lib/vdsm/v2v.py
M lib/vdsm/virt/migration.py
M lib/vdsm/virt/recovery.py
M lib/yajsonrpc/__init__.py
M lib/yajsonrpc/stompreactor.py
M tests/API_test.py
M tests/check_imports.py
M tests/cmdutils_test.py
M tests/common/proc_test.py
M tests/glob_test.py
M tests/passwords_test.py
M tests/testValidation.py
M tests/vmrecovery_test.py
M vdsm.spec.in
M vdsm/API.py
M vdsm/storage/fileSD.py
M vdsm/virt/vm.py
27 files changed, 33 insertions(+), 36 deletions(-)
Approvals:
Piotr Kliczewski: Looks good to me, but someone else must approve
Jenkins CI: Passed CI tests
Dan Kenigsberg: Looks good to me, approved
Francesco Romani: Looks good to me, but someone else must approve
Edward Haas: Verified
--
To view, visit https://gerrit.ovirt.org/77510
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I5b3693cac5ed36d2a9bd89d59bf0fd41049e57aa
Gerrit-PatchSet: 12
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Edward Haas <edwardh(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Edward Haas <edwardh(a)redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani(a)redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski(a)gmail.com>
Gerrit-Reviewer: gerrit-hooks <automation(a)ovirt.org>
7 years