Re: [libvirt] NBD TLS support in QEMU

Hi, On Fri, Sep 05, 2014 at 03:26:09PM +0200, Wouter Verhelst wrote: > Tunneling the entire protocol inside an SSL connection doesn't fix that; > if an attacker is able to hijack your TCP connections and change flags, > then this attacker is also able to hijack your TCP connection and > redirect it to a decrypting/encrypting proxy. > > I agree that preventing a possible SSL downgrade attack (and other forms > of MITM) should be high on the priority list, but "tunnel the whole > thing in SSL" doesn't do that. So, having given this some thought, I wanted to come up with a spec just so that we had something we could all agree on. As part of that, I had a look at qemu-nbd, and noticed that it uses the "oldstyle" handshake protocol (on port 10809 by default -- ew, please don't do that).