)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"5bfb72a921e909558a4cc21df8df9c4b2203025e","unresolved":false,"context_lines":[{"line_number":27,"context_line":"   ca_certs \u003d /pat/to/ca/cert.pem"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Implements bp: websocket-proxy-to-host-security"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Change-Id: I64859ad01120782fb17308aac3abb125597c3ea2"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"fa98f980_b7bb00e4","line":30,"updated":"2014-09-02 16:13:37.000000000","message":"Forgot to say it should have  \"SecurityImpact\" added.","commit_id":"b2dca76641b7a255adc46f995918f2292dfa35f1"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"dc9d953f2507eda1556b9007b1ed8788495886d5","unresolved":false,"context_lines":[{"line_number":15,"context_line":"well as CA certificates, and configure libvirt"},{"line_number":16,"context_line":"to pass the appropriate options to QEmu (this"},{"line_number":17,"context_line":"is configured globally for libvirt, not by Nova)."},{"line_number":18,"context_line":"This is process is documented on the libvirt"},{"line_number":19,"context_line":"website."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Then, the operator would enable this driver and"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":29,"id":"ba8a016a_95084293","line":18,"updated":"2015-11-20 23:15:36.000000000","message":"s/is process is/process is/","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"}],"nova/conf/security_proxy_drivers.py":[{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"fd91dd09cec171aeb87e2fa0c6cbc32493a10ec2","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"\"\"\"),"},{"line_number":92,"context_line":"]"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"def register_opts(conf):"},{"line_number":95,"context_line":"    conf.register_opts(console_proxy_tls_opts, \"console_proxy_tls\")"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-python","patch_set":38,"id":"1a122d0e_fb717a0d","line":93,"updated":"2016-04-26 12:44:03.000000000","message":"2 blank lines are expected","commit_id":"63f7516fcb5173f0c8576d5f207f7621f2a1c81c"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"fd91dd09cec171aeb87e2fa0c6cbc32493a10ec2","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"def list_opts():"},{"line_number":103,"context_line":"    return {\u0027DEFAULT\u0027: console_proxy_tls}"}],"source_content_type":"text/x-python","patch_set":38,"id":"1a122d0e_bb24220d","line":103,"updated":"2016-04-26 12:44:03.000000000","message":"s/console_proxy_tls/console_proxy_tls_opts","commit_id":"63f7516fcb5173f0c8576d5f207f7621f2a1c81c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"ddf4a47ed17f079c4c909d4d05ee0234ad5a8392","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2014-2016 Red Hat, Inc."},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":4,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":41,"id":"bab6814e_20cd9a31","line":1,"range":{"start_line":1,"start_character":12,"end_line":1,"end_character":16},"updated":"2016-05-25 19:40:52.000000000","message":"Why 2014?  This is a new file correct?","commit_id":"98a8eace68923039e5aa089106f6d2dda8d5da3b"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"6347bbec265c59b09f41a1cc343f5e14fb0dc684","unresolved":false,"context_lines":[{"line_number":17,"context_line":"console_proxy_tls_opts \u003d ["},{"line_number":18,"context_line":"    cfg.BoolOpt(\u0027use_x509_auth\u0027,"},{"line_number":19,"context_line":"                default\u003dTrue,"},{"line_number":20,"context_line":"                help\u003d\"\"\"Use x509 authentication in addition to TLS encryption."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Possible values:"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-python","patch_set":44,"id":"3aaa91ec_1e7699a3","line":20,"updated":"2016-07-01 01:05:10.000000000","message":"This means the console proxy authenticates itself to libvirt/qemu via client cert right?","commit_id":"6ead7e17049f667f2af2225a5a00ddf69651775e"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"cc133c04f17b5477cdbfcf1230398eca8dd9f597","unresolved":false,"context_lines":[{"line_number":17,"context_line":"console_proxy_tls_opts \u003d ["},{"line_number":18,"context_line":"    cfg.BoolOpt(\u0027use_x509_auth\u0027,"},{"line_number":19,"context_line":"                default\u003dTrue,"},{"line_number":20,"context_line":"                help\u003d\"\"\"Use x509 authentication in addition to TLS encryption."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Possible values:"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-python","patch_set":44,"id":"dada55a8_c902240b","line":20,"in_reply_to":"3aaa91ec_1e7699a3","updated":"2016-07-19 09:20:19.000000000","message":"Yes, that\u0027s correct. QEMU must be configured with require TLS + x509 cert auth for VNC, and this patches enables proxy to use that.","commit_id":"6ead7e17049f667f2af2225a5a00ddf69651775e"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"6347bbec265c59b09f41a1cc343f5e14fb0dc684","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"\"\"\"),"},{"line_number":37,"context_line":"    cfg.StrOpt(\u0027client_key\u0027,"},{"line_number":38,"context_line":"               help\u003d\"\"\"The path to the client certificate PEM file (for x509)"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Possible values:"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-python","patch_set":44,"id":"3aaa91ec_de3251f1","line":38,"updated":"2016-07-01 01:05:10.000000000","message":"Presumably this key must be unencrypted on disk?","commit_id":"6ead7e17049f667f2af2225a5a00ddf69651775e"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"cc133c04f17b5477cdbfcf1230398eca8dd9f597","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"\"\"\"),"},{"line_number":37,"context_line":"    cfg.StrOpt(\u0027client_key\u0027,"},{"line_number":38,"context_line":"               help\u003d\"\"\"The path to the client certificate PEM file (for x509)"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Possible values:"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-python","patch_set":44,"id":"dada55a8_042a637e","line":38,"in_reply_to":"3aaa91ec_de3251f1","updated":"2016-07-19 09:20:19.000000000","message":"Yep, correct.  If there\u0027s a standard mechanism nova/openstack uses for getting certs+keys for other services, which uses passwd protection we could adopt that here. I\u0027m not sure what other parts of Nova using x509 do offhand though.","commit_id":"6ead7e17049f667f2af2225a5a00ddf69651775e"}],"nova/console/security_proxy_drivers/tls.py":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"a3e2d5b47a3f7873806649338b38287589093c66","unresolved":false,"context_lines":[{"line_number":142,"context_line":"class TLSSecurityProxy(sec_proxy.WebSocketSecurityProxy):"},{"line_number":143,"context_line":"    VNC_HELPER \u003d VeNCryptSecurityProxyHelper"},{"line_number":144,"context_line":"    SPICE_HELPER \u003d None"},{"line_number":145,"context_line":"    GENERIC_HELPER \u003d None"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_332023f7","line":145,"updated":"2014-11-20 14:27:46.000000000","message":"As mentioned on the previous patch, I think this setup with a pair of classes is really bad approach. It is misleading to the user because it isn\u0027t provide any TLS security at all for SPICE and it is needlessly forcing us to use the same security proxy class for both SPICE \u0026 VNC. We should just directly request  VeNCryptSecurityProxy as an impl, not this indirect class.","commit_id":"f2af1c807dbdc387a08b24b446830e521d43980a"},{"author":{"_account_id":13670,"name":"ANish","email":"anish2good@yahoo.co.in"},"change_message_id":"faf316792e3cdf9167bf443f2f700e0af8949bf0","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    x509 authentication."},{"line_number":51,"context_line":"    \"\"\""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    VENCRYPT_AUTH_TYPE \u003d 19"},{"line_number":54,"context_line":"    X509NONE_SUBAUTH_TYPE \u003d 260"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    def choose_security_type(self, available_types):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a890539_cea12448","line":53,"updated":"2014-12-05 18:52:59.000000000","message":"Is this part of RFB protocol Specification ?","commit_id":"339605ebc6922bd68888682a7f3fc5dd38c07810"},{"author":{"_account_id":7677,"name":"Solly Ross","email":"sross@redhat.com","username":"sross"},"change_message_id":"2168912eae190bb18b8583d79336fbff8f0f2e0a","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    x509 authentication."},{"line_number":51,"context_line":"    \"\"\""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    VENCRYPT_AUTH_TYPE \u003d 19"},{"line_number":54,"context_line":"    X509NONE_SUBAUTH_TYPE \u003d 260"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    def choose_security_type(self, available_types):"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a961159_84ed1328","line":53,"in_reply_to":"5a890539_cea12448","updated":"2014-12-09 15:56:36.000000000","message":"Yes.","commit_id":"339605ebc6922bd68888682a7f3fc5dd38c07810"},{"author":{"_account_id":13670,"name":"ANish","email":"anish2good@yahoo.co.in"},"change_message_id":"faf316792e3cdf9167bf443f2f700e0af8949bf0","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"        return self.VENCRYPT_AUTH_TYPE"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    def security_handshake(self):"},{"line_number":65,"context_line":"        # get the VeNCrypt version from the server"},{"line_number":66,"context_line":"        maj_ver \u003d ord(self.server_sock.recv(1))"},{"line_number":67,"context_line":"        min_ver \u003d ord(self.server_sock.recv(1))"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a890539_49660ebd","line":64,"updated":"2014-12-05 18:52:59.000000000","message":"It\u0027s good to check the length of  handshake message for integrity purpose ?","commit_id":"339605ebc6922bd68888682a7f3fc5dd38c07810"},{"author":{"_account_id":13670,"name":"ANish","email":"anish2good@yahoo.co.in"},"change_message_id":"faf316792e3cdf9167bf443f2f700e0af8949bf0","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        LOG.debug(\"Server sent VeNCrypt version \""},{"line_number":70,"context_line":"                  \"%(maj)s.%(min)s\", {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver})"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"        if maj_ver \u003d\u003d 0 and min_ver \u003c 2:"},{"line_number":73,"context_line":"            reason \u003d _(\"Only VeNCrypt version 0.2 is supported by this \""},{"line_number":74,"context_line":"                       \"proxy, but the server wanted to use version \""},{"line_number":75,"context_line":"                       \"%(maj)s.%(min)s\") % {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver}"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a890539_69b74af9","line":72,"updated":"2014-12-05 18:52:59.000000000","message":"Is this vesrion check is  backward compatible?","commit_id":"339605ebc6922bd68888682a7f3fc5dd38c07810"},{"author":{"_account_id":7677,"name":"Solly Ross","email":"sross@redhat.com","username":"sross"},"change_message_id":"2168912eae190bb18b8583d79336fbff8f0f2e0a","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        LOG.debug(\"Server sent VeNCrypt version \""},{"line_number":70,"context_line":"                  \"%(maj)s.%(min)s\", {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver})"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"        if maj_ver \u003d\u003d 0 and min_ver \u003c 2:"},{"line_number":73,"context_line":"            reason \u003d _(\"Only VeNCrypt version 0.2 is supported by this \""},{"line_number":74,"context_line":"                       \"proxy, but the server wanted to use version \""},{"line_number":75,"context_line":"                       \"%(maj)s.%(min)s\") % {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver}"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a961159_44c40b5f","line":72,"in_reply_to":"5a890539_69b74af9","updated":"2014-12-09 15:56:36.000000000","message":"Yes, it should be.","commit_id":"339605ebc6922bd68888682a7f3fc5dd38c07810"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"dfbf73a46ce9794a6160f394e943a245186a5aa2","unresolved":false,"context_lines":[{"line_number":70,"context_line":"                  \"%(maj)s.%(min)s\", {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver})"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"        if maj_ver \u003d\u003d 0 and min_ver \u003c 2:"},{"line_number":73,"context_line":"            reason \u003d _(\"Only VeNCrypt version 0.2 is supported by this \""},{"line_number":74,"context_line":"                       \"proxy, but the server wanted to use version \""},{"line_number":75,"context_line":"                       \"%(maj)s.%(min)s\") % {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver}"},{"line_number":76,"context_line":"            raise exception.RFBSecurityNegotiationFailed(reason\u003dreason)"}],"source_content_type":"text/x-python","patch_set":21,"id":"3a961159_1b3467ab","line":73,"updated":"2015-01-09 16:30:52.000000000","message":"Nit: version 0.2 -\u003e versions \u003c 0.2","commit_id":"0b422ce6964baa2a6a36d3bd14cdf93f7c64fef8"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"dc9d953f2507eda1556b9007b1ed8788495886d5","unresolved":false,"context_lines":[{"line_number":38,"context_line":"]"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"CONF \u003d cfg.CONF"},{"line_number":41,"context_line":"CONF.register_opts(vencrypt_opts, \u0027console_proxy_tls\u0027)"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"class VeNCryptSecurityProxyHelper(sec_proxy.RFBSecurityProxyHelper):"}],"source_content_type":"text/x-python","patch_set":29,"id":"ba8a016a_406d3acb","line":41,"updated":"2015-11-20 23:15:36.000000000","message":"One of the focus items for Nova in Mitaka will be to better organize config options. I would suggest picking a name that other related config options could be moved into as part of that effort. Maybe just \"console\", or we could get a little more specific, but not as specific as to mention TLS. Long-term I don\u0027t think we\u0027d want TLS-related options separate from the other options related to VNC.","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"},{"author":{"_account_id":8190,"name":"Drew Thorstensen (thorst)","email":"thorst@us.ibm.com","username":"thorst"},"change_message_id":"623829b66e096cef8c856c0f41541f573d396625","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        can_use_version \u003d ord(self.server_sock.recv(1))"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"        if can_use_version \u003e 0:"},{"line_number":84,"context_line":"            reason \u003d _(\"Server could not use VeNCrypt version 0.2\")"},{"line_number":85,"context_line":"            raise exception.RFBSecurityNegotiationFailed(reason\u003dreason)"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        LOG.debug(\"Using VeNCrypt version 0.2\")"}],"source_content_type":"text/x-python","patch_set":29,"id":"ba8a016a_b5611fab","line":84,"updated":"2015-11-19 13:42:13.000000000","message":"Do you want to specify the version that the server suggested using instead?\n\nI understand the flow where if the version that comes back is too low...obviously we can\u0027t use a higher version.  This is slightly different...maybe some new version can\u0027t go back far enough (which makes sense).  But from the message you get back, it may be a little difficult for the operator to find the version that the server sent back (at least without debug on...which they probably don\u0027t want to do given the error condition).","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"da0c5d96b0ff46318edee82864ee2ac03c6be68d","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        can_use_version \u003d ord(self.server_sock.recv(1))"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"        if can_use_version \u003e 0:"},{"line_number":84,"context_line":"            reason \u003d _(\"Server could not use VeNCrypt version 0.2\")"},{"line_number":85,"context_line":"            raise exception.RFBSecurityNegotiationFailed(reason\u003dreason)"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        LOG.debug(\"Using VeNCrypt version 0.2\")"}],"source_content_type":"text/x-python","patch_set":29,"id":"ba8a016a_d80bbad4","line":84,"in_reply_to":"ba8a016a_b5611fab","updated":"2015-11-19 13:52:52.000000000","message":"The only version ever implemented or defined is 0.2. The 0.1 version was never implemented anywhere in the virt stack. I don\u0027t expect there to ever be a 0.3 either, since in future we\u0027ll likely define a completely new TLS extension.","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"dc9d953f2507eda1556b9007b1ed8788495886d5","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                        server_side\u003dFalse,"},{"line_number":124,"context_line":"                        cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":125,"context_line":"                        ca_certs\u003dCONF.console_proxy_tls.ca_certs,"},{"line_number":126,"context_line":"                        ssl_version\u003dssl.PROTOCOL_TLSv1)"},{"line_number":127,"context_line":"            else:"},{"line_number":128,"context_line":"                wrapped_sock \u003d ssl.wrap_socket(self.server_sock,"},{"line_number":129,"context_line":"                        server_side\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":29,"id":"ba8a016a_603f1ed7","line":126,"updated":"2015-11-20 23:15:36.000000000","message":"forcing TLS 1.0 here could actually be less secure than not specifying ssl_version. Not specifying would allow for the more secure TLS 1.1 and 1.2 (as well as the less secure SSLv3... but worry about that on the server side).","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"dc9d953f2507eda1556b9007b1ed8788495886d5","unresolved":false,"context_lines":[{"line_number":129,"context_line":"                        server_side\u003dFalse,"},{"line_number":130,"context_line":"                        cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":131,"context_line":"                        ca_certs\u003dCONF.console_proxy_tls.ca_certs,"},{"line_number":132,"context_line":"                        ssl_version\u003dssl.PROTOCOL_TLSv1)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"            LOG.debug(\"VeNCrypt security handshake accepted\")"},{"line_number":135,"context_line":"            return wrapped_sock"}],"source_content_type":"text/x-python","patch_set":29,"id":"ba8a016a_202276ba","line":132,"updated":"2015-11-20 23:15:36.000000000","message":"same as above","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"44250a55ade1501935455036dd6546d17e63e6aa","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright (c) 2014 Red Hat, Inc"},{"line_number":2,"context_line":"# All Rights Reserved."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a061dce_a1546b54","line":1,"updated":"2016-04-04 16:17:29.000000000","message":"s/2014/2016","commit_id":"8a2e1b22c4f1bab6077ad8669b2454bd37f58478"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"44250a55ade1501935455036dd6546d17e63e6aa","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"LOG \u003d logging.getLogger(__name__)"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"vencrypt_opts \u003d ["},{"line_number":29,"context_line":"    cfg.BoolOpt(\u0027use_x509_auth\u0027,"},{"line_number":30,"context_line":"                default\u003dTrue,"},{"line_number":31,"context_line":"                help\u003d\"Use x509 authentication in addition to TLS encryption\"),"}],"source_content_type":"text/x-python","patch_set":36,"id":"9a061dce_a1dbcbec","line":28,"updated":"2016-04-04 16:17:29.000000000","message":"I guess these options should to live in nova/conf/security_proxy_drivers.py and use the new template","commit_id":"8a2e1b22c4f1bab6077ad8669b2454bd37f58478"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"ddf4a47ed17f079c4c909d4d05ee0234ad5a8392","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright (c) 2014 Red Hat, Inc"},{"line_number":2,"context_line":"# All Rights Reserved."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-python","patch_set":41,"id":"bab6814e_80b3a699","line":1,"range":{"start_line":1,"start_character":16,"end_line":1,"end_character":20},"updated":"2016-05-25 19:40:52.000000000","message":"2016","commit_id":"98a8eace68923039e5aa089106f6d2dda8d5da3b"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"6347bbec265c59b09f41a1cc343f5e14fb0dc684","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def security_handshake(self):"},{"line_number":53,"context_line":"        # get the VeNCrypt version from the server"},{"line_number":54,"context_line":"        maj_ver \u003d ord(self.server_sock.recv(1))"},{"line_number":55,"context_line":"        min_ver \u003d ord(self.server_sock.recv(1))"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"        LOG.debug(\"Server sent VeNCrypt version \""}],"source_content_type":"text/x-python","patch_set":44,"id":"3aaa91ec_7eda3d79","line":54,"updated":"2016-07-01 01:05:10.000000000","message":"So here and all over the other patch, if our socket to the server is terminated server_sock.recv() will return an empty string and ord() will explode. Seems like maybe we should do better than that?","commit_id":"6ead7e17049f667f2af2225a5a00ddf69651775e"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"6347bbec265c59b09f41a1cc343f5e14fb0dc684","unresolved":false,"context_lines":[{"line_number":63,"context_line":"                       \"%(maj)s.%(min)s\") % {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver}"},{"line_number":64,"context_line":"            raise exception.RFBSecurityNegotiationFailed(reason\u003dreason)"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"        # use version 0.2"},{"line_number":67,"context_line":"        self.server_sock.sendall(\"\\x00\\x02\")"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"        can_use_version \u003d ord(self.server_sock.recv(1))"}],"source_content_type":"text/x-python","patch_set":44,"id":"3aaa91ec_3ea6f50e","line":66,"updated":"2016-07-01 01:05:10.000000000","message":"What if maj_ver \u003d\u003d 1 ? I see that we fail below if it NAKs it, but it seems weird to respond to a version like the above by trying something anyway.  Maybe this is just how the protocol is supposed to work?","commit_id":"6ead7e17049f667f2af2225a5a00ddf69651775e"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"cc133c04f17b5477cdbfcf1230398eca8dd9f597","unresolved":false,"context_lines":[{"line_number":63,"context_line":"                       \"%(maj)s.%(min)s\") % {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver}"},{"line_number":64,"context_line":"            raise exception.RFBSecurityNegotiationFailed(reason\u003dreason)"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"        # use version 0.2"},{"line_number":67,"context_line":"        self.server_sock.sendall(\"\\x00\\x02\")"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"        can_use_version \u003d ord(self.server_sock.recv(1))"}],"source_content_type":"text/x-python","patch_set":44,"id":"dada55a8_e463cfda","line":66,"in_reply_to":"3aaa91ec_3ea6f50e","updated":"2016-07-19 09:20:19.000000000","message":"NB, there\u0027s no server that exists which actually implemenmts the 0.1 protocol version - it was just something the original author of vencrypt used very briefly before going to version 0.2, which is what everything implements.","commit_id":"6ead7e17049f667f2af2225a5a00ddf69651775e"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"6347bbec265c59b09f41a1cc343f5e14fb0dc684","unresolved":false,"context_lines":[{"line_number":72,"context_line":"            reason \u003d _(\"Server could not use VeNCrypt version 0.2\")"},{"line_number":73,"context_line":"            raise exception.RFBSecurityNegotiationFailed(reason\u003dreason)"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"        LOG.debug(\"Using VeNCrypt version 0.2\")"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"        # get the supported sub-auth types"},{"line_number":78,"context_line":"        sub_types_cnt \u003d ord(self.server_sock.recv(1))"}],"source_content_type":"text/x-python","patch_set":44,"id":"3aaa91ec_3e7d556d","line":75,"updated":"2016-07-01 01:05:10.000000000","message":"Not sure this is useful.","commit_id":"6ead7e17049f667f2af2225a5a00ddf69651775e"}],"nova/console/security_proxy_helper.py":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0c94fa8ed5cc2ae69852b37adfc26d03f75f2d2c","unresolved":false,"context_lines":[{"line_number":285,"context_line":""},{"line_number":286,"context_line":"        # for some reason, the QEmu source code has a random U8 here"},{"line_number":287,"context_line":"        # that doesn\u0027t seem to be in the spec.  1 means acceptance,"},{"line_number":288,"context_line":"        # 0 means failure (unlike the rest of RFB)"},{"line_number":289,"context_line":"        auth_accepted \u003d ord(self.server_sock.recv(1))"},{"line_number":290,"context_line":"        if auth_accepted \u003d\u003d 0:"},{"line_number":291,"context_line":"            reason \u003d _(\"Server didn\u0027t accept the requrested auth sub-type\")"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_1741c2a8","line":288,"updated":"2014-08-29 10:42:07.000000000","message":"That\u0027s a bug in the spec. The GTK-VNC source also expects this U8 to be sent.","commit_id":"533b0d0f8b504746f72906398f19b82fd03439af"},{"author":{"_account_id":7677,"name":"Solly Ross","email":"sross@redhat.com","username":"sross"},"change_message_id":"39ff7512ffc2ba7261309f9d34ea277e33956a41","unresolved":false,"context_lines":[{"line_number":285,"context_line":""},{"line_number":286,"context_line":"        # for some reason, the QEmu source code has a random U8 here"},{"line_number":287,"context_line":"        # that doesn\u0027t seem to be in the spec.  1 means acceptance,"},{"line_number":288,"context_line":"        # 0 means failure (unlike the rest of RFB)"},{"line_number":289,"context_line":"        auth_accepted \u003d ord(self.server_sock.recv(1))"},{"line_number":290,"context_line":"        if auth_accepted \u003d\u003d 0:"},{"line_number":291,"context_line":"            reason \u003d _(\"Server didn\u0027t accept the requrested auth sub-type\")"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_9e04fd15","line":288,"in_reply_to":"1abeadc6_1741c2a8","updated":"2014-08-29 17:08:44.000000000","message":"Done","commit_id":"533b0d0f8b504746f72906398f19b82fd03439af"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0c94fa8ed5cc2ae69852b37adfc26d03f75f2d2c","unresolved":false,"context_lines":[{"line_number":295,"context_line":""},{"line_number":296,"context_line":"        global ssl"},{"line_number":297,"context_line":"        if ssl is None:"},{"line_number":298,"context_line":"            ssl \u003d __import__(\u0027ssl\u0027)"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"        try:"},{"line_number":301,"context_line":"            if CONF.console_proxy_tls.use_x509_auth:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_1728e2e0","line":298,"updated":"2014-08-29 10:42:07.000000000","message":"Any reason we can\u0027t just have  \u0027import ssl\u0027 at the top of the file ?","commit_id":"533b0d0f8b504746f72906398f19b82fd03439af"},{"author":{"_account_id":7677,"name":"Solly Ross","email":"sross@redhat.com","username":"sross"},"change_message_id":"39ff7512ffc2ba7261309f9d34ea277e33956a41","unresolved":false,"context_lines":[{"line_number":295,"context_line":""},{"line_number":296,"context_line":"        global ssl"},{"line_number":297,"context_line":"        if ssl is None:"},{"line_number":298,"context_line":"            ssl \u003d __import__(\u0027ssl\u0027)"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"        try:"},{"line_number":301,"context_line":"            if CONF.console_proxy_tls.use_x509_auth:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_63286e97","line":298,"in_reply_to":"1abeadc6_1728e2e0","updated":"2014-08-29 17:08:44.000000000","message":"There\u0027s no need to import ssl if you\u0027re not going to be using the SSL driver.","commit_id":"533b0d0f8b504746f72906398f19b82fd03439af"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0c94fa8ed5cc2ae69852b37adfc26d03f75f2d2c","unresolved":false,"context_lines":[{"line_number":318,"context_line":"            raise exception.RFBSecurityNegotiationFailed(reason\u003dreason)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            LOG.debug(\"VeNCrypt security handshake accepted\")"},{"line_number":321,"context_line":"            return wrapped_sock"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_f7b7e682","line":321,"updated":"2014-08-29 10:42:07.000000000","message":"Using an else: clause doesn\u0027t really add anything here since the lines here can\u0027t raise an exception.  Just move these two lines into the try clause.","commit_id":"533b0d0f8b504746f72906398f19b82fd03439af"},{"author":{"_account_id":7677,"name":"Solly Ross","email":"sross@redhat.com","username":"sross"},"change_message_id":"39ff7512ffc2ba7261309f9d34ea277e33956a41","unresolved":false,"context_lines":[{"line_number":318,"context_line":"            raise exception.RFBSecurityNegotiationFailed(reason\u003dreason)"},{"line_number":319,"context_line":"        else:"},{"line_number":320,"context_line":"            LOG.debug(\"VeNCrypt security handshake accepted\")"},{"line_number":321,"context_line":"            return wrapped_sock"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_fe141145","line":321,"in_reply_to":"1abeadc6_f7b7e682","updated":"2014-08-29 17:08:44.000000000","message":"Done","commit_id":"533b0d0f8b504746f72906398f19b82fd03439af"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"5bfb72a921e909558a4cc21df8df9c4b2203025e","unresolved":false,"context_lines":[{"line_number":302,"context_line":""},{"line_number":303,"context_line":"        global ssl"},{"line_number":304,"context_line":"        if ssl is None:"},{"line_number":305,"context_line":"            ssl \u003d __import__(\u0027ssl\u0027)"},{"line_number":306,"context_line":""},{"line_number":307,"context_line":"        try:"},{"line_number":308,"context_line":"            if CONF.console_proxy_tls.use_x509_auth:"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa98f980_d7d7a421","line":305,"updated":"2014-09-02 16:13:37.000000000","message":"I know you said you only wanted to import if people actually used the SSL proxy, but is there actually any harm to importing the ssl module regardless. Any deployment is surely going to have the module installed whether they enable this feature or not. So it feels uneccessary  todo this.","commit_id":"b2dca76641b7a255adc46f995918f2292dfa35f1"}],"nova/tests/console/test_security_proxy.py":[{"author":{"_account_id":8412,"name":"Mike Durnosvistov","email":"glacierr.dev@gmail.com","username":"mdurnosvistov"},"change_message_id":"d8dbd3c0f04c7c27c005d41689cd5d6a4a1af592","unresolved":false,"context_lines":[{"line_number":242,"context_line":"                          self.proxy.connect)"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"class VeNCryptSecurityProxyHelperTestCase(test.NoDBTestCase):"},{"line_number":246,"context_line":"    \"\"\"Test case for the base RFBSecurityProxyHelper.\"\"\""},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"    def setUp(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"1abeadc6_f0acaba2","line":245,"updated":"2014-08-20 10:13:47.000000000","message":"What the reason use `mox` library instead `mock` library?","commit_id":"2652a4a846a0f38e8d11f3e6945d6ccbcce7c5fb"},{"author":{"_account_id":7677,"name":"Solly Ross","email":"sross@redhat.com","username":"sross"},"change_message_id":"f34f004c5e11a442c53948c07acef144fbab5b8a","unresolved":false,"context_lines":[{"line_number":242,"context_line":"                          self.proxy.connect)"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"class VeNCryptSecurityProxyHelperTestCase(test.NoDBTestCase):"},{"line_number":246,"context_line":"    \"\"\"Test case for the base RFBSecurityProxyHelper.\"\"\""},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"    def setUp(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"1abeadc6_a2c9fb27","line":245,"in_reply_to":"1abeadc6_f0acaba2","updated":"2014-08-20 17:16:09.000000000","message":"see comment on previous commit","commit_id":"2652a4a846a0f38e8d11f3e6945d6ccbcce7c5fb"}],"nova/tests/unit/console/test_security_proxy.py":[{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"421417090525eec75311f8fa1f77d8c0866aa274","unresolved":false,"context_lines":[{"line_number":325,"context_line":""},{"line_number":326,"context_line":"        self.assertEqual(\"wrapped\", self.proxy.security_handshake())"},{"line_number":327,"context_line":""},{"line_number":328,"context_line":"        self.assertEqual(self.expected_calls, self.manager.mock_calls)"},{"line_number":329,"context_line":""},{"line_number":330,"context_line":"    def test_security_handshake_without_x509(self):"},{"line_number":331,"context_line":"        self.flags(use_x509_auth\u003dFalse, group\u003d\"console_proxy_tls\")"}],"source_content_type":"text/x-python","patch_set":21,"id":"3a961159_ad03390b","line":328,"updated":"2015-01-08 16:17:00.000000000","message":"i think a nicer way would have been: self.manager.assert_has_calls(self.expected_calls)\n\nsame for every assert below.","commit_id":"0b422ce6964baa2a6a36d3bd14cdf93f7c64fef8"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"dc9d953f2507eda1556b9007b1ed8788495886d5","unresolved":false,"context_lines":[{"line_number":264,"context_line":"                self.client_sock, self.server_sock)"},{"line_number":265,"context_line":"        self.flags(ca_certs\u003d\"/certs/ca.pem\", group\u003d\"console_proxy_tls\")"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"        sec_proxy_tls.ssl.CERT_REQUIRED \u003d 1"},{"line_number":268,"context_line":"        sec_proxy_tls.ssl.PROTOCOL_TLSv1 \u003d 2"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"    def test_choose_security_type(self):"}],"source_content_type":"text/x-python","patch_set":29,"id":"ba8a016a_5b0d2b36","line":267,"updated":"2015-11-20 23:15:36.000000000","message":"use imported rather than hardcoded values here","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"dc9d953f2507eda1556b9007b1ed8788495886d5","unresolved":false,"context_lines":[{"line_number":269,"context_line":""},{"line_number":270,"context_line":"    def test_choose_security_type(self):"},{"line_number":271,"context_line":"        sec_type \u003d self.proxy.choose_security_type("},{"line_number":272,"context_line":"                [1, self.proxy.VENCRYPT_AUTH_TYPE])"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"        self.assertEqual(self.proxy.VENCRYPT_AUTH_TYPE, sec_type)"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-python","patch_set":29,"id":"ba8a016a_3b6dc7cc","line":272,"updated":"2015-11-20 23:15:36.000000000","message":"what is 1? Avoid hardcoded values with no explanation of what they mean.","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"dc9d953f2507eda1556b9007b1ed8788495886d5","unresolved":false,"context_lines":[{"line_number":433,"context_line":""},{"line_number":434,"context_line":"        self._expect_recv(\u0027server\u0027, 1, \"\\x01\")"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        ex \u003d exception.RFBSecurityNegotiationFailed(reason\u003d\u0027cheese\u0027)"},{"line_number":437,"context_line":"        sec_proxy_tls.ssl.wrap_socket.side_effect \u003d ex"},{"line_number":438,"context_line":"        self.expected_calls.append("},{"line_number":439,"context_line":"                mock.call.ssl.wrap_socket(self.server_sock, server_side\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":29,"id":"ba8a016a_3b406707","line":436,"updated":"2015-11-20 23:15:36.000000000","message":"this should be ssl.SSLError","commit_id":"6d6336eb6bedd9faea9ec002950701c146501137"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"ddf4a47ed17f079c4c909d4d05ee0234ad5a8392","unresolved":false,"context_lines":[{"line_number":236,"context_line":""},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"class VeNCryptSecurityProxyHelperTestCase(test.NoDBTestCase):"},{"line_number":239,"context_line":"    \"\"\"Test case for the base RFBSecurityProxyHelper.\"\"\""},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"    def setUp(self):"},{"line_number":242,"context_line":"        super(VeNCryptSecurityProxyHelperTestCase, self).setUp()"}],"source_content_type":"text/x-python","patch_set":41,"id":"bab6814e_00569629","line":239,"range":{"start_line":239,"start_character":25,"end_line":239,"end_character":52},"updated":"2016-05-25 19:40:52.000000000","message":"Should be VeNCryptSecurityProxyHelperTestCase","commit_id":"98a8eace68923039e5aa089106f6d2dda8d5da3b"}]}