Xenserver glance plugin uses unsafe SSL connection

[Sean Dague]

plugins/xenserver/xenapi/etc/xapi.d/plugins/glance _upload_tarball uses httplib.HTTPSConnection objects. In Python 2.x those do not perform CA checks so client connections are vulnerable to MiM attacks.

This is the specific version of https://bugs.launchpad.net/nova/+bug/1188189.

[John Garbutt (johngarbutt)]

catch me on IRC if I can help out with this (johnthetubaguy)

[John Garbutt (johngarbutt)]

its all python 2.4 code down there, and we haven't managed to get unit tests sorted yet :(

[melanie witt (melwitt)]

Thanks John! I might not find you on IRC because of time difference. I noticed there aren't unit tests but I'm seeing if i can figure out how I can test it (not familiar with this script but wanted to help with bugs).

I have got some code -- haven't yet sorted how to let the script choose to be insecure (and not verify cert) if it wants. I'll put a review up today and add you so you can let me know what to change. :)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/125249

[OpenStack Infra (hudson-openstack)]

Change abandoned by Sean Dague (<email address hidden>) on branch: master
Review: https://review.openstack.org/125249
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Joe Gordon (jogo)]

patch is abandoned, not in progress

[Michael Still (mikal)]

Single hypervisor, so not critical.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Sean Dague (<email address hidden>) on branch: master
Review: https://review.openstack.org/125249
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Sean Dague (sdague)]

Due to limitations of the xen platform this is not really fixable. Closing.