17 Feb
2022
17 Feb
'22
3:05 p.m.
On Wed, Feb 16, 2022 at 09:41:17PM +0000, Richard W.M. Jones wrote:
Ignore the previous patch (I think). This change works better.
The filter is still kind of hairy, although I think I understand now the reasons why it is so!
Yep, CVE-2021-3716 mandates some of the complexity. I should at least push a patch adding more comments (including the CVE number) in tls-fallback.c, rather than assuming you can piece it together from the blurb in nbdkit-security.pod. And yes, this version is much better than your v1 (which would have reintroduced the CVE that this filter was designed to prevent). -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3266 Virtualization: qemu.org | libvirt.org