vmware driver does not validate server certificates

[Eric Brown]

The VMware driver establishes connections to vCenter over HTTPS, yet the vCenter server certificate is not verified as part of the connection process. I know this because my vCenter server is using a self-signed certificate which always fails certification verification. As a result, someone could use a man-in-the-middle attack to spoof the vcenter host to nova.

The vmware driver has a dependency on Suds, which I believe also does not validate certificates because hartsock and I noticed it uses urllib.

For reference, here is a link on secure connections in OpenStack:
https://wiki.openstack.org/wiki/SecureClientConnections

Assuming Suds is fixed to provide an option for certificate verification, next step would be to modify the vmware driver to provide an option to override invalid certificates (such as self-signed). In other parts of OpenStack, there are options to bypass the certificate check with a "insecure" option set, or you could put the server's certificate in the CA store.

[Eric Brown (ericwb)]

Opened a bug on pyvmomi - one of the future dependencies.
https://github.com/vmware/pyvmomi/issues/13

[Eric Brown (ericwb)]

Opened a bug on Suds:
https://github.com/pik4ez/python-suds/issues/2

[Visnusaran Murugan (visnusaran-murugan)]

Can be achieved be overriding suds transport to use requests library.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/111226

[Yalu Bai (yalu0311)]

i am so sorry,your comany's service isn't not well within my ISP,i compared
to other vpn providers,their service in my enviroment is very well,the
speed of connectivity is just three or five seconds ,but your service
commonly is three or five minutes,worsely can not connected to servers ,so
i insist on refunding ,please don't find any reason to answer me ,have no
relationship with the config or other reason,but the network your compnay
provided ,so don't delay the date to refund ,because several time's round
,the time is over ,so ,please deal with my refund ,thanks !

2014-08-13 3:06 GMT+08:00 Davanum Srinivas (DIMS) <email address hidden>:

> ** Also affects: oslo.vmware
> Importance: Undecided
> Status: New
>
> --
> You received this bug notification because you are subscribed to
> OpenStack Compute (nova).
> Matching subscriptions: clearity
> https://bugs.launchpad.net/bugs/1276207
>
> Title:
> vmware driver does not validate server certificates
>
> Status in Cinder:
> In Progress
> Status in OpenStack Compute (Nova):
> Confirmed
> Status in Oslo VMware library for OpenStack projects:
> New
>
> Bug description:
> The VMware driver establishes connections to vCenter over HTTPS, yet
> the vCenter server certificate is not verified as part of the
> connection process. I know this because my vCenter server is using a
> self-signed certificate which always fails certification verification.
> As a result, someone could use a man-in-the-middle attack to spoof the
> vcenter host to nova.
>
> The vmware driver has a dependency on Suds, which I believe also does
> not validate certificates because hartsock and I noticed it uses
> urllib.
>
> For reference, here is a link on secure connections in OpenStack:
> https://wiki.openstack.org/wiki/SecureClientConnections
>
> Assuming Suds is fixed to provide an option for certificate
> verification, next step would be to modify the vmware driver to
> provide an option to override invalid certificates (such as self-
> signed). In other parts of OpenStack, there are options to bypass the
> certificate check with a "insecure" option set, or you could put the
> server's certificate in the CA store.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/cinder/+bug/1276207/+subscriptions
>

[OpenStack Infra (hudson-openstack)]

Change abandoned by Mike Perez (<email address hidden>) on branch: master
Review: https://review.openstack.org/111226

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/179728

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/179753

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/179753
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=39478338bb4a1cbd625a6176d4403bb34a2a0630
Submitter: Jenkins
Branch: master

commit 39478338bb4a1cbd625a6176d4403bb34a2a0630
Author: Vipin Balachandran <email address hidden>
Date: Mon May 4 16:13:41 2015 +0530

    VMware: Enable vCenter certificate verification

    Currently vCenter certificate is not verified during connection
    establishment. This patch adds a config option to specify a CA
    bundle file to verify vCenter server certificate.

    DocImpact

    Change-Id: Ida730db66b154a4d445f7a91bccb9ca5b5a26f5e
    Closes-Bug: #1276207

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/180266

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/180266
Committed: https://git.openstack.org/cgit/openstack/ceilometer/commit/?id=2f4ff42a9257a51ca807ac534ca3e598e627a959
Submitter: Jenkins
Branch: master

commit 2f4ff42a9257a51ca807ac534ca3e598e627a959
Author: Eric Brown <email address hidden>
Date: Tue May 5 11:38:49 2015 -0700

    VMware: verify vCenter server certificate

    Two configuration properties are being added:

    'ca_file': Specify a CA bundle file to use in verifying the vCenter
    server certificate

    'insecure': If true, the vCenter server certificate is not verified.
    If false, then the default CA truststore is used for verification.
    This option is ignored if 'ca_file' is set.

    Closes-Bug: #1276207

    DocImpact

    Change-Id: I8f408308cddbb40b19e8dc9fce6ff02745d963b8

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/179728
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=823766637d2cdd45df75716553656e4650cb49ec
Submitter: Jenkins
Branch: master

commit 823766637d2cdd45df75716553656e4650cb49ec
Author: Radoslav Gerganov <email address hidden>
Date: Mon May 4 11:18:58 2015 +0300

    VMware: verify vCenter server certificate

    Two configuration properties are being added:
    'ca_file': Specify a CA bundle file to use in verifying the vCenter
    server certificate
    'insecure': If true, the vCenter server certificate is not verified.
    If false, then the default CA truststore is used for verification.
    This option is ignored if 'ca_file' is set.

    Closes-Bug: #1276207

    DocImpact

    Change-Id: I86a04fbd70f726206ddd95caf87685f3559d2ad8