Re: [Libvir] Register libvirtd ports with IANA ?

Daniel Veillard wrote: I don't know if we can detect TLS automatically. I guess it may be possible to detect the handshake message. Anyhow, the standard way[1] to do this is to establish the connection in unencrypted mode, then (as part of the protocol) upgrade the connection to an encrypted one. The STARTTLS RFC is quite enlightening: http://www.ietf.org/rfc/rfc2487.txt but their concerns also revolve around backwards compatibility -- it must always be possible to interoperate with non-TLS-supporting MTAs -- and that's not a problem that we have. Upgrading connections in this way is subject to an easy man-in-the-middle attack, unless the client and server are able to specify in some way that they only want to talk over a secured connection. I think we should wait on Dan's stuff before changing this. Rich. [1] From http://www.ietf.org/rfc/rfc2817.txt: At the Washington DC IETF meeting in December 1997, the Applications Area Directors and the IESG reaffirmed that the practice of issuing parallel "secure" port numbers should be deprecated. The HTTP/1.1 Upgrade mechanism can apply Transport Layer Security [6] to an open HTTP connection. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903