live_migrate task ignores extra_specs

[Bob Ball]

The new live_migrate task in the conductor does not pass extra_specs from the flavor through to the filters - thus giving an incorrect result.

This showed up when using the TrustedFilter which depends on extra_specs (set by nova.scheduler.utils.build_request_spec) - however nova.conductor.tasks.live_migrate.LiveMigrationTask._get_candidate_destination does not use this build_request_spec and builds it's own - which missed this extra_specs value.

Marked as a security vulnerability as it means that the use of live migration will bypass filters intended to provide a secure environment such as TrustedFilter.

[Jeremy Stanley (fungi)]

I'm a little fuzzy on the risk boundaries this crosses and to what degree it's exploitable--can you provide an example exploit scenario for this vulnerability? Also, when you refer to it as "the new live_migrate task" does this mean it's only in master/milestone-proposed/havana and not affecting any stable release branches?

[Bob Ball (bob-ball)]

It's not "exploitable" as such. The scenario is:

* Admin sets up a flavor to have a Trust requirement - so the instance will only boot on hosts which have been verified as trusted
* When booting the scheduler will correctly use the TrustedFilter to identify a host which is verified
* A live migration is requested by the administrator, without specifying a target host. In this scenario the conductor task does not correctly fill the parameters expected by the scheduler to enforce any trust requirements.

In this way an administrator may inadvertently move a VM to a host that may have been compromised (or, more precisely, that has not been verified as secure).

I have not checked the behavior for existing release branches - this is related to code accepted recently during H-3.

[Thierry Carrez (ttx)]

If this is havana-only, we should just open the bug and get it quickly fixed there (before release). We don't do OSSAs for vulnerabilities in the release-being-developed as long as the issue is fixed before final release, and this one would be questionable anyway (it's more like a bug with corner-case security consequences).

Let me know what you think of the idea of opening it.

[Bob Ball (bob-ball)]

Understood - I was in two minds about raising it as a security issue for those very reasons but decided to stick on the side of caution.
I'm very happy for it to just be opened up.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/46735

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/48641

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/48641
Committed: http://github.com/openstack/nova/commit/2bea97bae6120005e77f99640dcaacf911f77868
Submitter: Jenkins
Branch: master

commit 2bea97bae6120005e77f99640dcaacf911f77868
Author: Hans Lindgren <email address hidden>
Date: Fri Sep 27 13:10:58 2013 +0200

    Ensure image property not set to None in build_request_spec()

    This is in preparation for having scheduler.util.build_request_spec()
    construct the request_spec in the live migration code. Specifically, this
    change is needed to avoid reintroducing bug #1199811.

    Change-Id: I0cc6b6ec7be7a0afbe184b208f2e16fd5cd4452c
    Related-Bug: #1224014

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/46735
Committed: http://github.com/openstack/nova/commit/e80121a2c5ccac42f857b0628ea6f340eda1ca3a
Submitter: Jenkins
Branch: master

commit e80121a2c5ccac42f857b0628ea6f340eda1ca3a
Author: Hans Lindgren <email address hidden>
Date: Fri Sep 27 13:11:21 2013 +0200

    Make LiveMigrateTask use build_request_spec()

    Some filters like TrustedFilter makes use of extra_specs. Currently,
    when live-migration uses the scheduler to select a host, it constructs
    a request_spec that has no extra_specs in it.

    By making use of the existing helper method build_request_spec(), the
    request to the scheduler will include extra_specs.

    Change-Id: I5bc6c6418653c256a42da7b0a343086ec9863da1
    Closes-Bug: #1224014

[Openstack Gerrit (openstack-gerrit)]

Related fix proposed to branch: stable/havana
Review: https://review.openstack.org/91210

[OpenStack Infra (hudson-openstack)]

Change abandoned by liusheng (<email address hidden>) on branch: stable/havana
Review: https://review.openstack.org/91210