JuanFra Rodriguez Cardoso discovered that nova was not correctly enabling SSL parameters when using the qpid client. Enabling "qpid_protocol = ssl" in nova.conf would not result in SSL being used to commnicate to qpid. If qpid was not configured to enforce SSL this could lead to sensitive information being sent in the clear.
I don't think the qpid connection is actually successful, even with require_encryption off, so no data actually flows. Did you do any network tracing to confirm that data goes over the wire unencrypted?
Yes I did. It made the connection and worked as normal (with no ssl) even though ssl was enabled in the nova.conf. After applying the patch and restarting nova-compute it fails to connect to qpid (as I had not setup certificate etc.. in qpid).
So looking at the code. The Connection class in qpid.messaging has no attribute named "protocol". So in the nova qpid rpc implementation without the patch, all that is happening is a new str attribute called "protocol" is getting created and is then ignored. A regular tcp connection is made as the transport attribute is still set to 'tcp' which is the default.
Upstream bug report: https://bugs.launchpad.net/oslo/+bug/1158807
Ok, I see what you're saying. If you just set protocol to ssl it is basically a no-op. A user may not know to change the port as well.
This issue has been addressed in following products: OpenStack 3 for RHEL 6 Via RHSA-2014:0112 https://rhn.redhat.com/errata/RHSA-2014-0112.html