Conversation
nfc_service() hardcoded the NfcService moref as "nfcService", which is correct for vCenter but wrong for a bare ESXi host (where the moref is "ha-nfc-service"). Connecting directly to ESXi therefore failed with vmodl.fault.ManagedObjectNotFound. Fixed by resolving the moref dynamically via an internal RetrieveInternalContent SOAP call, the same way real VDDK does it (confirmed by an SSL-hook capture of native VDDK connecting to a bare ESXi 8.0.3 host). Also fixes connect_authd() for tickets that omit `host`: on a direct-ESXi ticket the field is absent entirely (the authd endpoint is implicitly the same host already logged into), which previously caused a plain None passed to socket.create_connection. Validated end-to-end (ConnectEx + Open + Read, both nbd and nbdssl transports) against a live standalone ESXi 8.0.3 host with no vCenter in the topology. Full protocol details and the wire-level differences from the vCenter-mediated path are in docs/nfc_auth.md.
|
@doccaz Hi, thanks a lot for opening those PRs! I'll review and test them as soon as possible. FYI: I'm working on "hotadd" and "san" transport support, I'll send those soon. We're also planing to do a rewrite in Rust in order to provide a C ABI compatible replacement for VDDK. It will probably be a separate branch called "rust". New features will probably still go in the pure-python implementation first since it's easier to test and extend. |
|
Nice! Happy to help. |
The OpenVixDiskLib integration tests currently expect vSphere credentials. We'll add a test class that specifically covers direct ESXi connections. An ESXi node will be picked from vSphere, using credentials from `.test_config.yaml`. If no ESXi credentials are provided, we'll try to use the default "root" user and the vSphere password.
|
I've added some integration tests that specifically target direct ESXi connections and fixed a linter error, I hope you don't mind. My PM informed me that we'll need a CLA before accepting external contributions. I'll review the other PRs in the meantime, I should have more information about the CLA soon. |
Please let us know when you have information about this. Will this be a copyright assignment or a more general agreement? And are there particular reasons why this would be needed? |
3 participants
Summary
nfc_service()hardcoded theNfcServicemoref as"nfcService", which is correct for vCenter but wrong for a bare ESXi host (moref is"ha-nfc-service"there). Connecting directly to ESXi therefore failed outright withvmodl.fault.ManagedObjectNotFound.Fixed by resolving the moref dynamically via an internal
RetrieveInternalContentSOAP call, the same way real VDDK does it — confirmed via an SSL-hook capture of native VDDK connecting to a bare ESXi 8.0.3 host.Also fixes
connect_authd()for tickets that omithost: a direct-ESXi ticket doesn't include this field at all (the authd endpoint is implicitly the same host already logged into over VIM), which previously resulted inNonebeing passed tosocket.create_connection.Full protocol details and the wire-level differences from the vCenter-mediated path are documented in
docs/nfc_auth.md.Test plan
ConnectEx+Open+Read, bothnbdandnbdssltransports) against a live standalone ESXi 8.0.3 host with no vCenter in the topologypytest tests/integration/test_nfc_auth.pypasses standaloneNote on PR sequencing
This is the first of 4 focused PRs splitting up what was originally one larger combined PR (#2, now closed). The other three (
GetInfo+DDB_GET,QueryAllocatedBlocks+NFC_DELTA_DISKinvestigation, and CBT) are independent of this one and can merge in any order — each was verified to build and pass its own tests standalone againstmaster.🤖 Generated with Claude Code