Jump to: navigation, search

SSLEndpoints

Revision as of 23:30, 17 February 2013 by Ryan Lane (talk | contribs) (Text replace - "__NOTOC__" to "")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
  • Created: Tue, 20 Dec 2011 13:45:07 -0800
  • Contributors: Gunther Hagleitner

SSL endpoints

Summary

In order to prevent malicious code or attackers to interfere with the operation of the OpenStack we propose to provide optional encryption and certificate verification via SSL on all endpoints (APIs, message queue & clients, DB).

See: https://bugs.launchpad.net/nova/+bug/790900

  • Note that this only sends in boolean true or false, while amqlib and carrot can send in a dictionary in python 2.6+

See: http://docs.python.org/library/ssl.html (ssl.wrap_socket)

See: http://code.google.com/p/py-amqplib/source/browse/amqplib/client_0_8/transport.py#189

Similar: http://wiki.openstack.org/nova-security-updates, https://blueprints.launchpad.net/nova/+spec/openstack-api-ssl

Design

The following enpoints need to have options to enable SSL encryption and verification:

  • EC2/OS API
  • Glance API
  • Message Queue (server)
  • Nova compute (db)
  • Nova compute (message queue, client)
  • Nova scheduler (message queue, client, db)
  • Nova network (message queue, client, db)
  • ... (any webservice + db)

The following blueprints have already started building ssl support:

Message queue communication

Database

This should work as the following:


mysql://$user:$pw@$host/$db?ssl_ca=$ca&ssl_key=$key&ssl_cert=$cert&ssl_capath=$capath&ssl_cipher=$cipher


Maybe also done in: http://wiki.openstack.org/nova-security-updates??

Glance

EC2/OS API

Expected Code Changes

Diablo branch (may change in essex):


nova/flags.py
nova/rpc.py


Expected Documentation Changes

Dependencies

python2.6+
OpenSSH
Erlang >= R13B
Erlang SSL


Test/Demo Plan

Migration Plan

Default (enable flag missing/off) will remain to be no SSL. No migration necessary.

Unresolved Issues

Notes

Contacts

hagleitn@yahoo-inc.com

Link