Difference between revisions of "Security/Juno/Marconi"
(→Implemented Crypto) |
m (→Libraries) |
||
Line 8: | Line 8: | ||
==== Libraries ==== | ==== Libraries ==== | ||
+ | |||
+ | Marconi's only crypto is in the keystone middleware and in libraries that are used by backend drivers. | ||
+ | |||
+ | '''Keystone''' | ||
+ | |||
+ | Marconi uses the standard Keystone WSGI middleware for authentication. | ||
+ | |||
+ | '''Backends''' | ||
+ | |||
+ | Marconi currently relies on pymongo and SQLAlchemy to implement storage drivers. SQLAlchemy is only used for development, and will likely be removed at the end of the Juno cycle. On the other hand, pymongo will be retained. It uses Python's standard "ssl" package ([https://github.com/mongodb/mongo-python-driver/blob/master/pymongo/pool.py source]). | ||
+ | |||
+ | During Juno we are also experimenting with Redis, AMQP, and Kafka drivers. | ||
+ | |||
+ | * The AMQP driver will use the Python bindings for qpid-proton, [https://svn.apache.org/repos/asf/qpid/proton/trunk/proton-c/src/ssl/ which uses OpenSSL]. | ||
+ | * Redis does not natively support TLS. It may be added by a proxy, but we are not planning on adding support for that to the Marconi driver at this time. | ||
+ | * Kafka does not appear to support TLS either. | ||
==== Encryption Algorithms ==== | ==== Encryption Algorithms ==== |
Revision as of 23:05, 10 June 2014
This page documents security related details for the Marconi project in the OpenStack Juno release.
Contents
Implemented Crypto
None. We would like to implement message signing for the K cycle, though. (TBD)
Used Crypto
Libraries
Marconi's only crypto is in the keystone middleware and in libraries that are used by backend drivers.
Keystone
Marconi uses the standard Keystone WSGI middleware for authentication.
Backends
Marconi currently relies on pymongo and SQLAlchemy to implement storage drivers. SQLAlchemy is only used for development, and will likely be removed at the end of the Juno cycle. On the other hand, pymongo will be retained. It uses Python's standard "ssl" package (source).
During Juno we are also experimenting with Redis, AMQP, and Kafka drivers.
- The AMQP driver will use the Python bindings for qpid-proton, which uses OpenSSL.
- Redis does not natively support TLS. It may be added by a proxy, but we are not planning on adding support for that to the Marconi driver at this time.
- Kafka does not appear to support TLS either.
Encryption Algorithms
Algorithm | Purpose | Configurable | Implementation | Details | Source |
---|---|---|---|---|---|
|
|
Hashing Algorithms
Algorithm | Purpose | Configurable | Implementation | Details | Source |
---|---|---|---|---|---|
|
|