Bug 1060717
| Summary: | vdsm does not validate certficate hostname from another vdsm. | |||
|---|---|---|---|---|
| Product: | [oVirt] ovirt-engine | Reporter: | Alon Bar-Lev <alonbl> | |
| Component: | General | Assignee: | Yaniv Bronhaim <ybronhei> | |
| Status: | CLOSED DEFERRED | QA Contact: | Jiri Belka <jbelka> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | --- | CC: | bazulay, bugs, lsvaty, mperina, oourfali, rbalakri, s.kieske, srevivo, wmealing | |
| Target Milestone: | --- | Flags: | ybronhei:
ovirt-4.2?
ylavi: planning_ack? ylavi: devel_ack? lsvaty: testing_ack+ |
|
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1164978 (view as bug list) | Environment: | ||
| Last Closed: | 2017-08-17 10:18:21 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | Infra | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1165015 | |||
While we at it, the following should also be validated: 1. certificate validFrom is honored. 2. certificate validTo is honored. 3. certificate key usage is honored, must have digitalSignature or keyEncipherment. 4. extended key usage is honored if exists, must contain TLS Web Server Authentication. see bug#1060215 comment#10 as well. need to fix vdsClient. need to fix vdsm<->vdsm. this applies as well to the new json rpc implementation. Gday Alon, Unless this has been assigned elsewhere I need to assign a CVE number to this issue. Do these issues all come from the same library / code in the vdsm repo or does affect multiple components ? this is per ovirt-engine implementation. probably also within vdsm implementation when communicate vdsm->vdsm. so you can open it on both. but provided the pki features that are not in use, for example revocation, I do not consider the PKI interaction with vdsm as anything else bug long password, the protocol could have just relayed on random key generated at install time and used for authentication. This is an automated message. This Bugzilla report has been opened on a version which is not maintained anymore. Please check if this bug is still relevant in oVirt 3.5.4. If it's not relevant anymore, please close it (you may use EOL or CURRENT RELEASE resolution) If it's an RFE please update the version to 4.0 if still relevant. Target release should be placed once a package build is known to fix a issue. Since this bug is not modified, the target version has been reset. Please use target milestone to plan a fix for a oVirt release. |
when engine communicate using TLS/SSL with vdsm it should validate certificate subject name against destination address. currently this is not performed. for some reason apache http client is used instead of standard j2se classes. please add host validation to this implementation. // provides client authentication. ProtocolSocketFactory factory = new AuthSSLProtocolSocketFactory(EngineEncryptionUtils.getKeyManagers(), EngineEncryptionUtils.getTrustManagers()); Protocol clientAuthHTTPS = new Protocol("https", factory, 54321); Protocol.registerProtocol("https", clientAuthHTTPS);