)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"console: introduce the VeNCrypt RFB authentication scheme"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Provide an implementation fot he VeNCrypt RFB authentication"},{"line_number":10,"context_line":"scheme, which uses TLS and x509 certificates to provide both"},{"line_number":11,"context_line":"encryption and mutual authentication / authorization."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"3a71b18c_906ecc94","line":9,"range":{"start_line":9,"start_character":26,"end_line":9,"end_character":32},"updated":"2016-12-02 15:23:26.000000000","message":"nit: s/fot he/for the/","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"console: introduce the VeNCrypt RFB authentication scheme"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Provide an implementation fot he VeNCrypt RFB authentication"},{"line_number":10,"context_line":"scheme, which uses TLS and x509 certificates to provide both"},{"line_number":11,"context_line":"encryption and mutual authentication / authorization."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"ba5201f7_4ccb9ea5","line":9,"range":{"start_line":9,"start_character":26,"end_line":9,"end_character":32},"in_reply_to":"3a71b18c_906ecc94","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"}],"nova/conf/vnc.py":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"1bfb2052b60d17d8d893bbf0cc77504a75b5ad4d","unresolved":false,"context_lines":[{"line_number":226,"context_line":""},{"line_number":227,"context_line":"    cfg.StrOpt("},{"line_number":228,"context_line":"        \u0027vencrypt_client_key\u0027,"},{"line_number":229,"context_line":"        default\u003dNone,"},{"line_number":230,"context_line":"        help\u003d\"\"\"The path to the client certificate PEM file (for x509)"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"Possible values:"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a77a97e_46985e6a","line":229,"updated":"2016-11-18 21:11:56.000000000","message":"default of None is unnecessary","commit_id":"23c014a06286a05d462c5f32c8055888fc3c5c89"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"1bfb2052b60d17d8d893bbf0cc77504a75b5ad4d","unresolved":false,"context_lines":[{"line_number":232,"context_line":"Possible values:"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":" * The fully qualified path to a PEM file containing the private key"},{"line_number":235,"context_line":"   to present to the compute node during VNC authentication"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Interdependencies to other options:"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"7a77a97e_669b9a66","line":235,"range":{"start_line":235,"start_character":45,"end_line":235,"end_character":59},"updated":"2016-11-18 21:11:56.000000000","message":"authentication.","commit_id":"23c014a06286a05d462c5f32c8055888fc3c5c89"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"1bfb2052b60d17d8d893bbf0cc77504a75b5ad4d","unresolved":false,"context_lines":[{"line_number":249,"context_line":"Possible values:"},{"line_number":250,"context_line":""},{"line_number":251,"context_line":" * The fully qualified path to a PEM file containing the x509 certificate"},{"line_number":252,"context_line":"   to present to the compute node during VNC authentication"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"Interdependencies to other options:"},{"line_number":255,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"7a77a97e_06b906cc","line":252,"range":{"start_line":252,"start_character":45,"end_line":252,"end_character":59},"updated":"2016-11-18 21:11:56.000000000","message":"authentication.","commit_id":"23c014a06286a05d462c5f32c8055888fc3c5c89"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"1bfb2052b60d17d8d893bbf0cc77504a75b5ad4d","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":" * The fully qualified path to a PEM file containing one or more"},{"line_number":269,"context_line":"   x509 certificates for the certificate authorities used by the"},{"line_number":270,"context_line":"   compute node VNC server"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Interdependencies to other options:"},{"line_number":273,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"7a77a97e_26bc42ba","line":270,"range":{"start_line":270,"start_character":20,"end_line":270,"end_character":26},"updated":"2016-11-18 21:11:56.000000000","message":"server.","commit_id":"23c014a06286a05d462c5f32c8055888fc3c5c89"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":228,"context_line":"        \u0027vencrypt_client_key\u0027,"},{"line_number":229,"context_line":"        help\u003d\"\"\"The path to the client certificate PEM file (for x509)"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"Possible values:"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":" * The fully qualified path to a PEM file containing the private key"},{"line_number":234,"context_line":"   to present to the compute node during VNC authentication."}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_96ca446d","line":231,"range":{"start_line":231,"start_character":0,"end_line":231,"end_character":15},"updated":"2016-12-02 15:23:26.000000000","message":"I think it\u0027s not really needed to use \"possible values\" here. It will always be a fqp to a file, there are not alternatives a user can select. I\u0027d just remove \"possible values\" header and remove the bullet point below.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":228,"context_line":"        \u0027vencrypt_client_key\u0027,"},{"line_number":229,"context_line":"        help\u003d\"\"\"The path to the client certificate PEM file (for x509)"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"Possible values:"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":" * The fully qualified path to a PEM file containing the private key"},{"line_number":234,"context_line":"   to present to the compute node during VNC authentication."}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_2c3bba9d","line":231,"range":{"start_line":231,"start_character":0,"end_line":231,"end_character":15},"in_reply_to":"3a71b18c_96ca446d","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":230,"context_line":""},{"line_number":231,"context_line":"Possible values:"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":" * The fully qualified path to a PEM file containing the private key"},{"line_number":234,"context_line":"   to present to the compute node during VNC authentication."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Interdependencies to other options:"},{"line_number":237,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_6a3e2429","line":234,"range":{"start_line":233,"start_character":0,"end_line":234,"end_character":60},"updated":"2016-11-28 14:18:54.000000000","message":"You shouldn\u0027t indent these as it results in a block quote\n\n    \u003csfinucan\u003e macsz: RE conf options - there\u0027s a reason for not indenting the bullet points under \u0027Related Options\u0027 etc, right?\n    \u003cmacsz\u003e sfinucan: yes, if you do indent, the doc generates the list in \u003cblockquote\u003e\n    \u003cmacsz\u003e sfinucan: example: http://docs.openstack.org/newton/config-reference/compute/config-options.html\n    \u003cmacsz\u003e and grep for consoleauth_topic \u003d consoleauth","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":230,"context_line":""},{"line_number":231,"context_line":"Possible values:"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":" * The fully qualified path to a PEM file containing the private key"},{"line_number":234,"context_line":"   to present to the compute node during VNC authentication."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Interdependencies to other options:"},{"line_number":237,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_967324e7","line":234,"range":{"start_line":233,"start_character":0,"end_line":234,"end_character":60},"in_reply_to":"5a74a57a_6a3e2429","updated":"2016-12-02 15:23:26.000000000","message":"nit: maybe rephrase that a little to make clear that the VNC proxy server will use this file. Maybe:\n\n    \"The fully qualified path to a PEM file containing the\n    private key which the VNC proxy server presents to the\n    compute node during VNC authentication.\"\n\nThat\u0027s probably not 100% perfect English but I hope you get what I\u0027m trying to say here.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":233,"context_line":" * The fully qualified path to a PEM file containing the private key"},{"line_number":234,"context_line":"   to present to the compute node during VNC authentication."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Interdependencies to other options:"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":" * ``vnc.auth_schemes``: must include \"vencrypt\""},{"line_number":239,"context_line":" * ``vnc.vencrypt_client_cert```: must also be set"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_ea1874d5","line":236,"range":{"start_line":236,"start_character":0,"end_line":236,"end_character":35},"updated":"2016-11-28 14:18:54.000000000","message":"Use\n\n    Related options:\n\ninstead","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":233,"context_line":" * The fully qualified path to a PEM file containing the private key"},{"line_number":234,"context_line":"   to present to the compute node during VNC authentication."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Interdependencies to other options:"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":" * ``vnc.auth_schemes``: must include \"vencrypt\""},{"line_number":239,"context_line":" * ``vnc.vencrypt_client_cert```: must also be set"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_2c301a9e","line":236,"range":{"start_line":236,"start_character":0,"end_line":236,"end_character":35},"in_reply_to":"5a74a57a_ea1874d5","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":237,"context_line":""},{"line_number":238,"context_line":" * ``vnc.auth_schemes``: must include \"vencrypt\""},{"line_number":239,"context_line":" * ``vnc.vencrypt_client_cert```: must also be set"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"\"\"\"),"},{"line_number":242,"context_line":""},{"line_number":243,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_ca7ad8f0","line":240,"updated":"2016-11-28 14:18:54.000000000","message":"nit: you might kill these extra newlines","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":237,"context_line":""},{"line_number":238,"context_line":" * ``vnc.auth_schemes``: must include \"vencrypt\""},{"line_number":239,"context_line":" * ``vnc.vencrypt_client_cert```: must also be set"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"\"\"\"),"},{"line_number":242,"context_line":""},{"line_number":243,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_2cd73a24","line":240,"in_reply_to":"5a74a57a_ca7ad8f0","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":239,"context_line":" * ``vnc.vencrypt_client_cert```: must also be set"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"\"\"\"),"},{"line_number":242,"context_line":""},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"    cfg.StrOpt("},{"line_number":245,"context_line":"        \u0027vencrypt_client_cert\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_aabf5ca8","line":242,"range":{"start_line":242,"start_character":0,"end_line":242,"end_character":0},"updated":"2016-11-28 14:18:54.000000000","message":"super nit: Despite my comments to the contrary in the previous patch, perhaps you might remove the extra spaces in between these options to prevent the need to rework this file","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":239,"context_line":" * ``vnc.vencrypt_client_cert```: must also be set"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"\"\"\"),"},{"line_number":242,"context_line":""},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"    cfg.StrOpt("},{"line_number":245,"context_line":"        \u0027vencrypt_client_cert\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_0cd4361e","line":242,"range":{"start_line":242,"start_character":0,"end_line":242,"end_character":0},"in_reply_to":"5a74a57a_aabf5ca8","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":248,"context_line":"Possible values:"},{"line_number":249,"context_line":""},{"line_number":250,"context_line":" * The fully qualified path to a PEM file containing the x509 certificate"},{"line_number":251,"context_line":"   to present to the compute node during VNC authentication."},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"Interdependencies to other options:"},{"line_number":254,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_1151de0e","line":251,"updated":"2016-12-02 15:23:26.000000000","message":"same rephrasing suggestion as in lines 233+234\n\n    \"The fully qualified path to a PEM file containing the\n    x509 certificate which the VNC proxy server presents to\n    the compute node during VNC authentication.\"","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":248,"context_line":"Possible values:"},{"line_number":249,"context_line":""},{"line_number":250,"context_line":" * The fully qualified path to a PEM file containing the x509 certificate"},{"line_number":251,"context_line":"   to present to the compute node during VNC authentication."},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"Interdependencies to other options:"},{"line_number":254,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_6ce142fe","line":251,"in_reply_to":"3a71b18c_1151de0e","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"2cae458fdc39071f848f98a4ae3cf8b4d74239b0","unresolved":false,"context_lines":[{"line_number":230,"context_line":""},{"line_number":231,"context_line":"Possible values:"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"* \"none\": allow connection without authentication"},{"line_number":234,"context_line":"\"\"\"),"},{"line_number":235,"context_line":"    cfg.StrOpt("},{"line_number":236,"context_line":"        \u0027vencrypt_client_key\u0027,"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_4a65abe0","line":233,"updated":"2018-01-12 17:13:07.000000000","message":"Missing \"vencrypt\" here; also, when you add it, if you use this value, do the other options below *have* to be set for it to work?","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"d83938d30d7c483802591a70c9c7f0b0be1f7f54","unresolved":false,"context_lines":[{"line_number":230,"context_line":""},{"line_number":231,"context_line":"Possible values:"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"* \"none\": allow connection without authentication"},{"line_number":234,"context_line":"\"\"\"),"},{"line_number":235,"context_line":"    cfg.StrOpt("},{"line_number":236,"context_line":"        \u0027vencrypt_client_key\u0027,"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_eaf3579d","line":233,"in_reply_to":"7f96bb07_4a65abe0","updated":"2018-01-12 17:45:15.000000000","message":"Darn. FWIW, this is why I wrote https://review.openstack.org/#/c/526012/","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"}],"nova/console/rfb/auth.py":[{"author":{"_account_id":9514,"name":"Brent Tang","email":"btang@us.ibm.com","username":"brenttang"},"change_message_id":"5754a83d7d3969c97c05ce94501411ff50c7233b","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    AUTH_SCHEME_MAP \u003d {"},{"line_number":55,"context_line":"        \"none\": \"nova.console.rfb.authnone.RFBAuthSchemeNone\","},{"line_number":56,"context_line":"        \"vencrypt\": \"nova.console.rfb.authnone.RFBAuthSchemeVeNCrypt\","},{"line_number":57,"context_line":"    }"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def __init__(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"dada55a8_63528736","line":56,"range":{"start_line":56,"start_character":38,"end_line":56,"end_character":46},"updated":"2016-07-22 05:05:13.000000000","message":"I know this is probably still in progress but one thing I noticed when trying this out was a typo, this seems like it should be \"authvencrypt\" for the module name rather than authnone (assume a copy from the previous one).","commit_id":"4f8dc40ecf22753626516856d2149d59d39c771a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    AUTH_SCHEME_MAP \u003d {"},{"line_number":55,"context_line":"        \"none\": \"nova.console.rfb.authnone.RFBAuthSchemeNone\","},{"line_number":56,"context_line":"        \"vencrypt\": \"nova.console.rfb.authvencrypt.RFBAuthSchemeVeNCrypt\","},{"line_number":57,"context_line":"    }"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def __init__(self):"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_e56987fa","line":56,"range":{"start_line":56,"start_character":19,"end_line":56,"end_character":74},"updated":"2016-11-28 14:18:54.000000000","message":"As with previous patch, this would make more sense as an actual module, IMO","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    AUTH_SCHEME_MAP \u003d {"},{"line_number":55,"context_line":"        \"none\": \"nova.console.rfb.authnone.RFBAuthSchemeNone\","},{"line_number":56,"context_line":"        \"vencrypt\": \"nova.console.rfb.authvencrypt.RFBAuthSchemeVeNCrypt\","},{"line_number":57,"context_line":"    }"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def __init__(self):"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_ac788a2c","line":56,"range":{"start_line":56,"start_character":19,"end_line":56,"end_character":74},"in_reply_to":"3a71b18c_b1f2ead0","updated":"2017-01-04 17:35:13.000000000","message":"I think I have resolved this now","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    AUTH_SCHEME_MAP \u003d {"},{"line_number":55,"context_line":"        \"none\": \"nova.console.rfb.authnone.RFBAuthSchemeNone\","},{"line_number":56,"context_line":"        \"vencrypt\": \"nova.console.rfb.authvencrypt.RFBAuthSchemeVeNCrypt\","},{"line_number":57,"context_line":"    }"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def __init__(self):"}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_b1f2ead0","line":56,"range":{"start_line":56,"start_character":19,"end_line":56,"end_character":74},"in_reply_to":"5a74a57a_e56987fa","updated":"2016-12-02 15:23:26.000000000","message":"IIUC the import of auth schemes as strings instead of modules was done to avoid circular dependencies/imports. If that cannot be resolved otherwise, we should at least have a NOTE here which explains this a little.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    MSLOGON \u003d 0xfffffffa  # Used by UltraVNC"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"class AuthVeNCryptSubtype(enum.IntEnum):"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    PLAIN \u003d 256"},{"line_number":46,"context_line":"    TLSNONE \u003d 257"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_1fd0471f","line":43,"updated":"2018-01-12 16:53:59.000000000","message":"Are these codes documented somewhere? If so, would be good to link that in here as a comment. Same above for AuthType.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    MSLOGON \u003d 0xfffffffa  # Used by UltraVNC"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"class AuthVeNCryptSubtype(enum.IntEnum):"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    PLAIN \u003d 256"},{"line_number":46,"context_line":"    TLSNONE \u003d 257"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_9f8a1719","line":43,"range":{"start_line":43,"start_character":6,"end_line":43,"end_character":25},"updated":"2018-01-12 16:53:59.000000000","message":"Why not define this enum in the authvencrypt module?","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"d83938d30d7c483802591a70c9c7f0b0be1f7f54","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    MSLOGON \u003d 0xfffffffa  # Used by UltraVNC"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"class AuthVeNCryptSubtype(enum.IntEnum):"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    PLAIN \u003d 256"},{"line_number":46,"context_line":"    TLSNONE \u003d 257"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_8aedf38c","line":43,"in_reply_to":"7f96bb07_1fd0471f","updated":"2018-01-12 17:45:15.000000000","message":"\u003e Are these codes documented somewhere? If so, would be good to link\n \u003e that in here as a comment. Same above for AuthType.\n\nThe closest I could find was referencing in a number of other projects. I don\u0027t think there\u0027s an RFC with this info in it.\n\n[1] https://github.com/qemu/qemu/blob/7398166ddf7c6dbbc9cae6ac69bb2feda14b40ac/ui/vnc.h#L369-L379\n[2] https://github.com/nmap/nmap/blob/bb0a7f557e7281b1f859a915b0028162fd97818d/nselib/vnc.lua#L38-L59","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"}],"nova/console/rfb/authvencrypt.py":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"1bfb2052b60d17d8d893bbf0cc77504a75b5ad4d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright (c) 2014-2016 Red Hat, Inc"},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":4,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a77a97e_a6c85256","line":1,"range":{"start_line":1,"start_character":16,"end_line":1,"end_character":21},"updated":"2016-11-18 21:11:56.000000000","message":"New file, so just 2016","commit_id":"23c014a06286a05d462c5f32c8055888fc3c5c89"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"666c9a181b8d51e1d0d9d4fad093ae9bc4902fd2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright (c) 2014-2016 Red Hat, Inc"},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":4,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a77a97e_cbbff55e","line":1,"range":{"start_line":1,"start_character":16,"end_line":1,"end_character":21},"in_reply_to":"7a77a97e_a6c85256","updated":"2016-11-21 09:57:38.000000000","message":"Nope, this accurately reflects the code history.","commit_id":"23c014a06286a05d462c5f32c8055888fc3c5c89"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    This security proxy helper uses the VeNCrypt security"},{"line_number":34,"context_line":"    type to achieve SSL/TLS-secured VNC.  It supports both"},{"line_number":35,"context_line":"    standard SSL/TLS encryption and SSL/TLS encryption with"},{"line_number":36,"context_line":"    x509 authentication."},{"line_number":37,"context_line":"    \"\"\""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    def security_type(self):"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_a58b0f67","line":36,"updated":"2016-11-28 14:18:54.000000000","message":"I found your blog [1] very useful in understanding how this was all working. Perhaps you could link to that from here?\n\n[1] https://www.berrange.com/~dan/vencrypt.txt","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    This security proxy helper uses the VeNCrypt security"},{"line_number":34,"context_line":"    type to achieve SSL/TLS-secured VNC.  It supports both"},{"line_number":35,"context_line":"    standard SSL/TLS encryption and SSL/TLS encryption with"},{"line_number":36,"context_line":"    x509 authentication."},{"line_number":37,"context_line":"    \"\"\""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    def security_type(self):"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_cc786ef5","line":36,"in_reply_to":"5a74a57a_a58b0f67","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":69,"context_line":""},{"line_number":70,"context_line":"        if can_use_version \u003e 0:"},{"line_number":71,"context_line":"            reason \u003d _(\"Server could not use VeNCrypt version 0.2\")"},{"line_number":72,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"        # get the supported sub-auth types"},{"line_number":75,"context_line":"        sub_types_cnt \u003d ord(recv(1))"}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_a3c0e17d","line":72,"updated":"2016-12-02 15:23:26.000000000","message":"Maybe we can extract lines 52-72 into a method called \"_ensure_version()\"","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"        # get the supported sub-auth types"},{"line_number":75,"context_line":"        sub_types_cnt \u003d ord(recv(1))"},{"line_number":76,"context_line":"        sub_types_raw \u003d recv(sub_types_cnt * 4)"},{"line_number":77,"context_line":"        sub_types \u003d struct.unpack(\u0027!\u0027 + str(sub_types_cnt) + \u0027I\u0027,"},{"line_number":78,"context_line":"                                  sub_types_raw)"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_2330519e","line":76,"range":{"start_line":76,"start_character":45,"end_line":76,"end_character":46},"updated":"2016-12-02 15:23:26.000000000","message":"I don\u0027t get this magic number. Would you replace that by a constant with meaningful name or leave a NOTE here?","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"        # get the supported sub-auth types"},{"line_number":75,"context_line":"        sub_types_cnt \u003d ord(recv(1))"},{"line_number":76,"context_line":"        sub_types_raw \u003d recv(sub_types_cnt * 4)"},{"line_number":77,"context_line":"        sub_types \u003d struct.unpack(\u0027!\u0027 + str(sub_types_cnt) + \u0027I\u0027,"},{"line_number":78,"context_line":"                                  sub_types_raw)"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_a747c31b","line":76,"range":{"start_line":76,"start_character":45,"end_line":76,"end_character":46},"in_reply_to":"3a71b18c_2330519e","updated":"2017-01-04 17:35:13.000000000","message":"This would be the number of characters used by each subtype. Comment added.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"        LOG.debug(\"Server supports VeNCrypt sub-types %s\", sub_types)"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"        if constants.AUTH_VENCRYPT_SUBTYPE_X509NONE not in sub_types:"},{"line_number":83,"context_line":"            reason \u003d _(\"Server does not support the x509None (%s) VeNCrypt\""},{"line_number":84,"context_line":"                       \" sub-auth type\") % \\"},{"line_number":85,"context_line":"                       constants.AUTH_VENCRYPT_SUBTYPE_X509NONE"}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_6394fae1","line":82,"updated":"2016-12-02 15:23:26.000000000","message":"I don\u0027t get it why this type is special here. Lines 33-36 made me believe that x509 is one of two possible ways to use this encryption.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"        LOG.debug(\"Server supports VeNCrypt sub-types %s\", sub_types)"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"        if constants.AUTH_VENCRYPT_SUBTYPE_X509NONE not in sub_types:"},{"line_number":83,"context_line":"            reason \u003d _(\"Server does not support the x509None (%s) VeNCrypt\""},{"line_number":84,"context_line":"                       \" sub-auth type\") % \\"},{"line_number":85,"context_line":"                       constants.AUTH_VENCRYPT_SUBTYPE_X509NONE"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_2778338f","line":82,"in_reply_to":"3a71b18c_6394fae1","updated":"2017-01-04 17:35:13.000000000","message":"It appears that X509None is the only x.509 subtype that doesn\u0027t manage authentication unlike the other subtypes. Seeing as we have already taken care of authentication through other means, we only want the encryption part here. This is a guess though :/","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":89,"context_line":"                  constants.AUTH_VENCRYPT_SUBTYPE_X509NONE)"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"        compute_sock.sendall(struct.pack("},{"line_number":92,"context_line":"            \u0027!I\u0027, constants.AUTH_VENCRYPT_SUBTYPE_X509NONE))"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"        # NB(sross): the spec is missing a U8 here that\u0027s used in"},{"line_number":95,"context_line":"        # multiple implementations (e.g. QEMU, GTK-VNC).  1 means"}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_2364d147","line":92,"range":{"start_line":92,"start_character":13,"end_line":92,"end_character":15},"updated":"2016-12-02 15:23:26.000000000","message":"Can we hide that struct formatting \u0027!I\u0027 [1]? Maybe move it into the ComputeSock class?\n\n[1] https://docs.python.org/2/library/struct.html","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":89,"context_line":"                  constants.AUTH_VENCRYPT_SUBTYPE_X509NONE)"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"        compute_sock.sendall(struct.pack("},{"line_number":92,"context_line":"            \u0027!I\u0027, constants.AUTH_VENCRYPT_SUBTYPE_X509NONE))"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"        # NB(sross): the spec is missing a U8 here that\u0027s used in"},{"line_number":95,"context_line":"        # multiple implementations (e.g. QEMU, GTK-VNC).  1 means"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_27cbd31f","line":92,"range":{"start_line":92,"start_character":13,"end_line":92,"end_character":15},"in_reply_to":"3a71b18c_2364d147","updated":"2017-01-04 17:35:13.000000000","message":"It\u0027s not always structs that we send (see line 66) so I don\u0027t think so :/","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":95,"context_line":"        # multiple implementations (e.g. QEMU, GTK-VNC).  1 means"},{"line_number":96,"context_line":"        # acceptance, # 0 means failure (unlike the rest of RFB)"},{"line_number":97,"context_line":"        auth_accepted \u003d ord(recv(1))"},{"line_number":98,"context_line":"        if auth_accepted \u003d\u003d 0:"},{"line_number":99,"context_line":"            reason \u003d _(\"Server didn\u0027t accept the requested auth sub-type\")"},{"line_number":100,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_83d756ec","line":98,"range":{"start_line":98,"start_character":28,"end_line":98,"end_character":29},"updated":"2016-12-02 15:23:26.000000000","message":"Maybe we can use a constant for this.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":95,"context_line":"        # multiple implementations (e.g. QEMU, GTK-VNC).  1 means"},{"line_number":96,"context_line":"        # acceptance, # 0 means failure (unlike the rest of RFB)"},{"line_number":97,"context_line":"        auth_accepted \u003d ord(recv(1))"},{"line_number":98,"context_line":"        if auth_accepted \u003d\u003d 0:"},{"line_number":99,"context_line":"            reason \u003d _(\"Server didn\u0027t accept the requested auth sub-type\")"},{"line_number":100,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_a76ee393","line":98,"range":{"start_line":98,"start_character":28,"end_line":98,"end_character":29},"in_reply_to":"3a71b18c_83d756ec","updated":"2017-01-04 17:35:13.000000000","message":"True, but it would only be used here. Does the comment above captures this adequately as is?","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        LOG.debug(\"Server accepted the requested sub-auth type\")"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"        try:"},{"line_number":105,"context_line":"            if (CONF.vnc.vencrypt_client_key is not None and"},{"line_number":106,"context_line":"                CONF.vnc.vencrypt_client_cert is not None):"},{"line_number":107,"context_line":"                wrapped_sock \u003d ssl.wrap_socket(compute_sock,"},{"line_number":108,"context_line":"                        keyfile\u003dCONF.vnc.vencrypt_client_key,"},{"line_number":109,"context_line":"                        certfile\u003dCONF.vnc.vencrypt_client_cert,"},{"line_number":110,"context_line":"                        server_side\u003dFalse,"},{"line_number":111,"context_line":"                        cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":112,"context_line":"                        ca_certs\u003dCONF.vnc.vencrypt_ca_certs)"},{"line_number":113,"context_line":"            else:"},{"line_number":114,"context_line":"                wrapped_sock \u003d ssl.wrap_socket(compute_sock,"},{"line_number":115,"context_line":"                        server_side\u003dFalse,"},{"line_number":116,"context_line":"                        cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":117,"context_line":"                        ca_certs\u003dCONF.vnc.vencrypt_ca_certs)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"            LOG.debug(\"VeNCrypt security handshake accepted\")"},{"line_number":120,"context_line":"            return wrapped_sock"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_250fff88","line":117,"range":{"start_line":105,"start_character":0,"end_line":117,"end_character":60},"updated":"2016-11-28 14:18:54.000000000","message":"From looking at the \u0027ssl\u0027 docs [1][2], it seems \u0027keyfile\u0027 and \u0027certfile\u0027 both default to \u0027None\u0027 for Python 2.7 and 3.4. To me, this would negate the need for this if-else block by always using the call in the first block.\n\nIf you\u0027re using this if-else to determine if both key and cert conf settings are set, you should probably do that explicitly and fail fast, rather than ignoring the one configured options.\n\n[1] https://docs.python.org/2/library/ssl.html#ssl.wrap_socket\n[2] https://docs.python.org/3.4/library/ssl.html#ssl.wrap_socket","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        LOG.debug(\"Server accepted the requested sub-auth type\")"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"        try:"},{"line_number":105,"context_line":"            if (CONF.vnc.vencrypt_client_key is not None and"},{"line_number":106,"context_line":"                CONF.vnc.vencrypt_client_cert is not None):"},{"line_number":107,"context_line":"                wrapped_sock \u003d ssl.wrap_socket(compute_sock,"},{"line_number":108,"context_line":"                        keyfile\u003dCONF.vnc.vencrypt_client_key,"},{"line_number":109,"context_line":"                        certfile\u003dCONF.vnc.vencrypt_client_cert,"},{"line_number":110,"context_line":"                        server_side\u003dFalse,"},{"line_number":111,"context_line":"                        cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":112,"context_line":"                        ca_certs\u003dCONF.vnc.vencrypt_ca_certs)"},{"line_number":113,"context_line":"            else:"},{"line_number":114,"context_line":"                wrapped_sock \u003d ssl.wrap_socket(compute_sock,"},{"line_number":115,"context_line":"                        server_side\u003dFalse,"},{"line_number":116,"context_line":"                        cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":117,"context_line":"                        ca_certs\u003dCONF.vnc.vencrypt_ca_certs)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"            LOG.debug(\"VeNCrypt security handshake accepted\")"},{"line_number":120,"context_line":"            return wrapped_sock"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_27e113d1","line":117,"range":{"start_line":105,"start_character":0,"end_line":117,"end_character":60},"in_reply_to":"5a74a57a_250fff88","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":116,"context_line":"                        cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":117,"context_line":"                        ca_certs\u003dCONF.vnc.vencrypt_ca_certs)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"            LOG.debug(\"VeNCrypt security handshake accepted\")"},{"line_number":120,"context_line":"            return wrapped_sock"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"        except ssl.SSLError as e:"}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_23276213","line":119,"range":{"start_line":119,"start_character":16,"end_line":119,"end_character":21},"updated":"2016-12-02 15:23:26.000000000","message":"I *assume* that an operator could be interested in the result of the CeNCrypt handshake, so maybe use an INFO level here?","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":116,"context_line":"                        cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":117,"context_line":"                        ca_certs\u003dCONF.vnc.vencrypt_ca_certs)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"            LOG.debug(\"VeNCrypt security handshake accepted\")"},{"line_number":120,"context_line":"            return wrapped_sock"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"        except ssl.SSLError as e:"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_e7d70beb","line":119,"range":{"start_line":119,"start_character":16,"end_line":119,"end_character":21},"in_reply_to":"3a71b18c_23276213","updated":"2017-01-04 17:35:13.000000000","message":"Agreed, and done.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"016f79060e590a9807db604c7222a240fede6428","unresolved":false,"context_lines":[{"line_number":65,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"        # use version 0.2"},{"line_number":68,"context_line":"        compute_sock.sendall(\"\\x00\\x02\")"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"        can_use_version \u003d ord(recv(1))"},{"line_number":71,"context_line":""}],"source_content_type":"text/x-python","patch_set":29,"id":"9f91af0f_7170a0a6","line":68,"updated":"2018-01-03 18:33:22.000000000","message":"This appears to be failing the py35 job with a TypeError when enabling this code flow:\n\nhttp://logs.openstack.org/50/530950/1/check/legacy-tempest-dsvm-py35/1dffae7/logs/screen-n-novnc.txt.gz?level\u003dTRACE#_Jan_03_16_09_08_830407\n\nJan 03 16:09:08.825983 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy Traceback (most recent call last):\nJan 03 16:09:08.826115 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/websockify/websocket.py\", line 930, in top_new_client\nJan 03 16:09:08.826268 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     client \u003d self.do_handshake(startsock, address)\nJan 03 16:09:08.826397 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/websockify/websocket.py\", line 860, in do_handshake\nJan 03 16:09:08.826530 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     self.RequestHandlerClass(retsock, address, self)\nJan 03 16:09:08.826666 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/opt/stack/new/nova/nova/console/websocketproxy.py\", line 240, in __init__\nJan 03 16:09:08.826808 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     websockify.ProxyRequestHandler.__init__(self, *args, **kwargs)\nJan 03 16:09:08.826935 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/websockify/websocket.py\", line 114, in __init__\nJan 03 16:09:08.827062 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     SimpleHTTPRequestHandler.__init__(self, req, addr, server)\nJan 03 16:09:08.827197 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/lib/python3.5/socketserver.py\", line 681, in __init__\nJan 03 16:09:08.827330 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     self.handle()\nJan 03 16:09:08.827461 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/websockify/websocket.py\", line 581, in handle\nJan 03 16:09:08.827587 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     SimpleHTTPRequestHandler.handle(self)\nJan 03 16:09:08.827737 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/lib/python3.5/http/server.py\", line 422, in handle\nJan 03 16:09:08.827866 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     self.handle_one_request()\nJan 03 16:09:08.828000 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/lib/python3.5/http/server.py\", line 410, in handle_one_request\nJan 03 16:09:08.828135 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     method()\nJan 03 16:09:08.828267 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/websockify/websocket.py\", line 543, in do_GET\nJan 03 16:09:08.828398 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     if not self.handle_websocket():\nJan 03 16:09:08.828531 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/websockify/websocket.py\", line 531, in handle_websocket\nJan 03 16:09:08.828675 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     self.new_websocket_client()\nJan 03 16:09:08.828803 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/opt/stack/new/nova/nova/console/websocketproxy.py\", line 213, in new_websocket_client\nJan 03 16:09:08.828944 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     tsock \u003d self.server.security_proxy.connect(tenant_sock, tsock)\nJan 03 16:09:08.829078 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/opt/stack/new/nova/nova/console/securityproxy/rfb.py\", line 174, in connect\nJan 03 16:09:08.829207 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     compute_sock \u003d scheme.security_handshake(compute_sock)\nJan 03 16:09:08.829344 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/opt/stack/new/nova/nova/console/rfb/authvencrypt.py\", line 68, in security_handshake\nJan 03 16:09:08.829472 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     compute_sock.sendall(\"\\x00\\x02\")\nJan 03 16:09:08.829612 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/eventlet/greenio/base.py\", line 390, in sendall\nJan 03 16:09:08.829745 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     tail \u003d self.send(data, flags)\nJan 03 16:09:08.829881 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/eventlet/greenio/base.py\", line 384, in send\nJan 03 16:09:08.830018 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     return self._send_loop(self.fd.send, data, flags)\nJan 03 16:09:08.830145 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy   File \"/usr/local/lib/python3.5/dist-packages/eventlet/greenio/base.py\", line 371, in _send_loop\nJan 03 16:09:08.830276 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy     return send_method(data, *args)\nJan 03 16:09:08.830407 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy TypeError: a bytes-like object is required, not \u0027str\u0027\nJan 03 16:09:08.830549 ubuntu-xenial-inap-mtl01-0001668490 nova-novncproxy[20546]: ERROR nova.console.websocketproxy","commit_id":"921129c926c1209b1b4652e162d9fd55579e0c67"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"8a8a7c75d5e9fe5989484e8c5ce4a509b75419e8","unresolved":false,"context_lines":[{"line_number":65,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"        # use version 0.2"},{"line_number":68,"context_line":"        compute_sock.sendall(\"\\x00\\x02\")"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"        can_use_version \u003d ord(recv(1))"},{"line_number":71,"context_line":""}],"source_content_type":"text/x-python","patch_set":29,"id":"9f91af0f_23a5e004","line":68,"in_reply_to":"9f91af0f_7170a0a6","updated":"2018-01-04 11:23:34.000000000","message":"This is resolved here:\n\nhttps://review.openstack.org/#/c/345398/31/nova/console/websocketproxy.py","commit_id":"921129c926c1209b1b4652e162d9fd55579e0c67"},{"author":{"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},"change_message_id":"7ebf704dfcd7ddd0acc290475362ad2b668213bb","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":121,"context_line":"                ca_certs\u003dCONF.vnc.vencrypt_ca_certs)"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"            LOG.info(_LI(\"VeNCrypt security handshake accepted\"))"},{"line_number":124,"context_line":"            return wrapped_sock"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        except ssl.SSLError as e:"}],"source_content_type":"text/x-python","patch_set":29,"id":"bf8cb3f7_06c6ec68","line":123,"range":{"start_line":123,"start_character":21,"end_line":123,"end_character":25},"updated":"2017-12-21 05:11:23.000000000","message":"nit: It is no longer necessary.","commit_id":"921129c926c1209b1b4652e162d9fd55579e0c67"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from nova.console.rfb import auth"},{"line_number":22,"context_line":"from nova import exception"},{"line_number":23,"context_line":"from nova.i18n import _, _LI"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"LOG \u003d logging.getLogger(__name__)"},{"line_number":26,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_1f95a740","line":23,"range":{"start_line":23,"start_character":25,"end_line":23,"end_character":28},"updated":"2018-01-12 16:53:59.000000000","message":"We don\u0027t use these anymore.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        LOG.debug(\"Server sent VeNCrypt version \""},{"line_number":59,"context_line":"                  \"%(maj)s.%(min)s\", {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver})"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"        if maj_ver !\u003d 0 or min_ver !\u003d 2:"},{"line_number":62,"context_line":"            reason \u003d _(\"Only VeNCrypt version 0.2 is supported by this \""},{"line_number":63,"context_line":"                       \"proxy, but the server wanted to use version \""},{"line_number":64,"context_line":"                       \"%(maj)s.%(min)s\") % {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver}"},{"line_number":65,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"        # use version 0.2"},{"line_number":68,"context_line":"        compute_sock.sendall(b\"\\x00\\x02\")"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_ffa79ba6","line":65,"range":{"start_line":61,"start_character":8,"end_line":65,"end_character":65},"updated":"2018-01-12 16:53:59.000000000","message":"Seems like this is going to hurt us later when there becomes an allowed range of vencrypt versions, but I guess we can deal with that when we get there...\n\nOr is 0.2 just the minimum required version and we should allow \u003e\u003d0.2?\n\nMake sure this is documented in the user/admin docs.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"d83938d30d7c483802591a70c9c7f0b0be1f7f54","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        LOG.debug(\"Server sent VeNCrypt version \""},{"line_number":59,"context_line":"                  \"%(maj)s.%(min)s\", {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver})"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"        if maj_ver !\u003d 0 or min_ver !\u003d 2:"},{"line_number":62,"context_line":"            reason \u003d _(\"Only VeNCrypt version 0.2 is supported by this \""},{"line_number":63,"context_line":"                       \"proxy, but the server wanted to use version \""},{"line_number":64,"context_line":"                       \"%(maj)s.%(min)s\") % {\u0027maj\u0027: maj_ver, \u0027min\u0027: min_ver}"},{"line_number":65,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"        # use version 0.2"},{"line_number":68,"context_line":"        compute_sock.sendall(b\"\\x00\\x02\")"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_6a9f4703","line":65,"range":{"start_line":61,"start_character":8,"end_line":65,"end_character":65},"in_reply_to":"7f96bb07_ffa79ba6","updated":"2018-01-12 17:45:15.000000000","message":"These things appear to be pretty much static. vencrypt 0.2.6 was released in 2006. It\u0027s doubtful there\u0027ll be any more development here.\n\nhttp://sibecker.co.uk/vencrypt.html","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":70,"context_line":"        can_use_version \u003d ord(recv(1))"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"        if can_use_version \u003e 0:"},{"line_number":73,"context_line":"            reason \u003d _(\"Server could not use VeNCrypt version 0.2\")"},{"line_number":74,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"        # get the supported sub-auth types"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_ffc0fb2c","line":73,"updated":"2018-01-12 16:53:59.000000000","message":"Is there something the operator should check for why this doesn\u0027t work? Are there vencrypt logs they can look at? Might be good to mention breadcrumbs, or at least make sure this is in the docs for this feature.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"d83938d30d7c483802591a70c9c7f0b0be1f7f54","unresolved":false,"context_lines":[{"line_number":70,"context_line":"        can_use_version \u003d ord(recv(1))"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"        if can_use_version \u003e 0:"},{"line_number":73,"context_line":"            reason \u003d _(\"Server could not use VeNCrypt version 0.2\")"},{"line_number":74,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"        # get the supported sub-auth types"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_4a728be5","line":73,"in_reply_to":"7f96bb07_ffc0fb2c","updated":"2018-01-12 17:45:15.000000000","message":"Not really. Its likely a misconfiguration. They\u0027ve told us they support 0.2 and we\u0027ve told them we\u0027re happy with 0.2. This is really here \"to be sure, to be sure\". Refer to 7.1.1 of the spec [1]\n\n[1] https://tools.ietf.org/html/rfc6143#section-7.1.1","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":87,"context_line":"                       auth.AuthVeNCryptSubtype.X509NONE"},{"line_number":88,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"        LOG.debug(\"Attempting to use the x509None (%s) auth sub-type\","},{"line_number":91,"context_line":"                  auth.AuthVeNCryptSubtype.X509NONE)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"        compute_sock.sendall(struct.pack("}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_df217ffd","line":90,"updated":"2018-01-12 16:53:59.000000000","message":"What are all of the other subtypes for then? Why is this one used here? Maybe a comment about what this is doing is needed.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"        LOG.debug(\"Server accepted the requested sub-auth type\")"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"        if (CONF.vnc.vencrypt_client_key and"},{"line_number":107,"context_line":"                CONF.vnc.vencrypt_client_cert):"},{"line_number":108,"context_line":"            client_key \u003d CONF.vnc.vencrypt_client_key"},{"line_number":109,"context_line":"            client_cert \u003d CONF.vnc.vencrypt_client_cert"},{"line_number":110,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_5f832fcd","line":107,"range":{"start_line":106,"start_character":8,"end_line":107,"end_character":47},"updated":"2018-01-12 16:53:59.000000000","message":"This seems unnecessary since these already default to None.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"d83938d30d7c483802591a70c9c7f0b0be1f7f54","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"        LOG.debug(\"Server accepted the requested sub-auth type\")"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"        if (CONF.vnc.vencrypt_client_key and"},{"line_number":107,"context_line":"                CONF.vnc.vencrypt_client_cert):"},{"line_number":108,"context_line":"            client_key \u003d CONF.vnc.vencrypt_client_key"},{"line_number":109,"context_line":"            client_cert \u003d CONF.vnc.vencrypt_client_cert"},{"line_number":110,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_0a55631d","line":107,"range":{"start_line":106,"start_character":8,"end_line":107,"end_character":47},"in_reply_to":"7f96bb07_5f832fcd","updated":"2018-01-12 17:45:15.000000000","message":"Right, but there\u0027s no way to say we need both of these set. This is all or nothing. Perhaps a log would be appropriate here.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                cert_reqs\u003dssl.CERT_REQUIRED,"},{"line_number":121,"context_line":"                ca_certs\u003dCONF.vnc.vencrypt_ca_certs)"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"            LOG.info(_LI(\"VeNCrypt security handshake accepted\"))"},{"line_number":124,"context_line":"            return wrapped_sock"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        except ssl.SSLError as e:"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_9f2bf7e9","line":123,"range":{"start_line":123,"start_character":21,"end_line":123,"end_character":24},"updated":"2018-01-12 16:53:59.000000000","message":"We don\u0027t use these anymore.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b2e76217cc8b3badcc1f87b97e73d1bc3e8edb4c","unresolved":false,"context_lines":[{"line_number":124,"context_line":"            return wrapped_sock"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        except ssl.SSLError as e:"},{"line_number":127,"context_line":"            reason \u003d _(\"Error establishing TLS connection to server: %s\") % e"},{"line_number":128,"context_line":"            raise exception.RFBAuthHandshakeFailed(reason\u003dreason)"}],"source_content_type":"text/x-python","patch_set":36,"id":"7f96bb07_3f3ae333","line":127,"range":{"start_line":127,"start_character":76,"end_line":127,"end_character":77},"updated":"2018-01-12 16:53:59.000000000","message":"Need to wrap this in six.text_type to avoid unicode issues.","commit_id":"c5a1a9e711b9d22f70403c338629e370ffa98d5a"}],"nova/console/rfb/constants.py":[{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":30,"context_line":"AUTH_TYPE_SASL \u003d 20  # SASL type used by VINO and QEMU"},{"line_number":31,"context_line":"AUTH_TYPE_ARD \u003d 30  # Apple remote desktop (screen sharing)"},{"line_number":32,"context_line":"AUTH_TYPE_MSLOGON \u003d 0xfffffffa  # Used by UltraVNC"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"AUTH_VENCRYPT_SUBTYPE_PLAIN \u003d 256"},{"line_number":35,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSNONE \u003d 257"},{"line_number":36,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSVNC \u003d 258"}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_d54d8173","line":33,"updated":"2016-12-02 15:23:26.000000000","message":"As in the previous change of this serious, I think using an enum here would help to encapsulate things: https://github.com/openstack/nova/blob/99ca2ea96f5166bee7d406f1f9bf434227d76f86/nova/objects/fields.py#L91","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":30,"context_line":"AUTH_TYPE_SASL \u003d 20  # SASL type used by VINO and QEMU"},{"line_number":31,"context_line":"AUTH_TYPE_ARD \u003d 30  # Apple remote desktop (screen sharing)"},{"line_number":32,"context_line":"AUTH_TYPE_MSLOGON \u003d 0xfffffffa  # Used by UltraVNC"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"AUTH_VENCRYPT_SUBTYPE_PLAIN \u003d 256"},{"line_number":35,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSNONE \u003d 257"},{"line_number":36,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSVNC \u003d 258"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_a7d7c3bd","line":33,"in_reply_to":"3a71b18c_d54d8173","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":38,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509NONE \u003d 260"},{"line_number":39,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509VNC \u003d 261"},{"line_number":40,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509PLAIN \u003d 262"},{"line_number":41,"context_line":"AUTH_VENCRYPT_SUBTYPE_X590SASL \u003d 263"},{"line_number":42,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSSASL \u003d 264"}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_63595a5a","line":41,"range":{"start_line":41,"start_character":22,"end_line":41,"end_character":26},"updated":"2016-12-02 15:23:26.000000000","message":"Is this really x590 or is it transposed digits and it should be x509?","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":38,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509NONE \u003d 260"},{"line_number":39,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509VNC \u003d 261"},{"line_number":40,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509PLAIN \u003d 262"},{"line_number":41,"context_line":"AUTH_VENCRYPT_SUBTYPE_X590SASL \u003d 263"},{"line_number":42,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSSASL \u003d 264"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_5d5b4e87","line":41,"range":{"start_line":41,"start_character":22,"end_line":41,"end_character":26},"in_reply_to":"3a71b18c_63595a5a","updated":"2017-01-04 17:35:13.000000000","message":"Good catch - x509 would appear to be the correct option\n\n  https://www.ietf.org/proceedings/43/I-D/draft-ietf-ldapext-x509-sasl-00.txt","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":31,"context_line":"AUTH_TYPE_ARD \u003d 30  # Apple remote desktop (screen sharing)"},{"line_number":32,"context_line":"AUTH_TYPE_MSLOGON \u003d 0xfffffffa  # Used by UltraVNC"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"AUTH_VENCRYPT_SUBTYPE_PLAIN \u003d 256"},{"line_number":35,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSNONE \u003d 257"},{"line_number":36,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSVNC \u003d 258"},{"line_number":37,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSPLAIN \u003d 259"},{"line_number":38,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509NONE \u003d 260"},{"line_number":39,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509VNC \u003d 261"},{"line_number":40,"context_line":"AUTH_VENCRYPT_SUBTYPE_X509PLAIN \u003d 262"},{"line_number":41,"context_line":"AUTH_VENCRYPT_SUBTYPE_X590SASL \u003d 263"},{"line_number":42,"context_line":"AUTH_VENCRYPT_SUBTYPE_TLSSASL \u003d 264"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_857533fb","line":42,"range":{"start_line":34,"start_character":0,"end_line":42,"end_character":35},"updated":"2016-11-28 14:18:54.000000000","message":"These seem very much like something that should be kept in authvencrypt.py itself. Any advantage to keeping them in a separate file?","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"}],"nova/tests/unit/console/rfb/test_authvencrypt.py":[{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"75133943a900218f089855bb634d9a4a9869bc3b","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"# under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"import mock"},{"line_number":16,"context_line":"import ssl"},{"line_number":17,"context_line":"import struct"},{"line_number":18,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_05b4c37f","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":11},"updated":"2016-11-28 14:18:54.000000000","message":"nit: not a standard library import","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"# under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"import mock"},{"line_number":16,"context_line":"import ssl"},{"line_number":17,"context_line":"import struct"},{"line_number":18,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_c794c7e3","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":11},"in_reply_to":"5a74a57a_05b4c37f","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        self.scheme \u003d authvencrypt.RFBAuthSchemeVeNCrypt()"},{"line_number":31,"context_line":"        self.compute_sock \u003d mock.MagicMock()"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"        self.compute_sock.recv.side_effect \u003d []"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"        self.expected_calls \u003d []"},{"line_number":36,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_38878cd8","line":33,"updated":"2016-12-02 15:23:26.000000000","message":"Is this line necessary? The compute_sock attribute gets newly assigned in line 31, so the list of side effects should be empty, I guess.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        self.scheme \u003d authvencrypt.RFBAuthSchemeVeNCrypt()"},{"line_number":31,"context_line":"        self.compute_sock \u003d mock.MagicMock()"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"        self.compute_sock.recv.side_effect \u003d []"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"        self.expected_calls \u003d []"},{"line_number":36,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_a72183b6","line":33,"in_reply_to":"3a71b18c_38878cd8","updated":"2017-01-04 17:35:13.000000000","message":"By default it\u0027s None. We set it to the empty list instead so we can safely append to it in \u0027_expect_recv\u0027 below","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":112,"context_line":"        self._expect_recv(1, \"\\x00\")"},{"line_number":113,"context_line":"        self._expect_recv(1, \"\\x01\")"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        self.assertRaises(exception.RFBAuthHandshakeFailed,"},{"line_number":116,"context_line":"                          self.scheme.security_handshake,"},{"line_number":117,"context_line":"                          self.compute_sock)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        self.assertEqual(self.expected_calls, self.compute_sock.mock_calls)"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_986340dc","line":117,"range":{"start_line":115,"start_character":0,"end_line":117,"end_character":44},"updated":"2016-12-02 15:23:26.000000000","message":"maybe introduce a method \"_assert_fails_handshake()\"? These 3 lines are used multiple times here.","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":112,"context_line":"        self._expect_recv(1, \"\\x00\")"},{"line_number":113,"context_line":"        self._expect_recv(1, \"\\x01\")"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        self.assertRaises(exception.RFBAuthHandshakeFailed,"},{"line_number":116,"context_line":"                          self.scheme.security_handshake,"},{"line_number":117,"context_line":"                          self.compute_sock)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        self.assertEqual(self.expected_calls, self.compute_sock.mock_calls)"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_625b092f","line":117,"range":{"start_line":115,"start_character":0,"end_line":117,"end_character":44},"in_reply_to":"3a71b18c_986340dc","updated":"2017-01-04 17:35:13.000000000","message":"Done","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3339ec8355b31a6ce0ec9c581ccb0e5dbae5b383","unresolved":false,"context_lines":[{"line_number":116,"context_line":"                          self.scheme.security_handshake,"},{"line_number":117,"context_line":"                          self.compute_sock)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        self.assertEqual(self.expected_calls, self.compute_sock.mock_calls)"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"    def test_security_handshake_fails_on_cant_use_version(self):"},{"line_number":122,"context_line":"        self._expect_recv(1, \"\\x00\")"}],"source_content_type":"text/x-python","patch_set":9,"id":"3a71b18c_58a448a5","line":119,"updated":"2016-12-02 15:23:26.000000000","message":"looks like the mock framework doesn\u0027t offer some kind of \"strict mode\" which checks by itself that mocked calls did really happen. As this line is the same for every test here, maybe introduce a method \"_assert_mock_calls()\" or maybe move it into the teardown method?","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"943b1cedc99b9906f6bfc9e2f9e1f0f97166d6f0","unresolved":false,"context_lines":[{"line_number":116,"context_line":"                          self.scheme.security_handshake,"},{"line_number":117,"context_line":"                          self.compute_sock)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        self.assertEqual(self.expected_calls, self.compute_sock.mock_calls)"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"    def test_security_handshake_fails_on_cant_use_version(self):"},{"line_number":122,"context_line":"        self._expect_recv(1, \"\\x00\")"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_4258c532","line":119,"in_reply_to":"3a71b18c_58a448a5","updated":"2017-01-04 17:35:13.000000000","message":"Done as part of the above","commit_id":"860ad44b964fd8fdfa2b1194b7b34ddf4fbcf42a"}]}