)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"ad952b3f6b9b203dd5abe08f25d7e703e2a025dd","unresolved":false,"context_lines":[{"line_number":10,"context_line":"encryption between the console proxy servers and the"},{"line_number":11,"context_line":"compute nodes for SPICE, VNC and serial ports."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Previously approved: Juno, Kilo, Mitaka, Newton"},{"line_number":14,"context_line":"Blueprint websocket-proxy-to-host-security"},{"line_number":15,"context_line":"Change-Id: I44b472d0907606885ff75ffce27dc3f46f6565f4"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3a98d1f4_51cdb0b5","line":13,"updated":"2016-10-01 23:03:22.000000000","message":"This was previously approved but you\u0027ve adjusted it quite a bit since the original spec and change, I think you basically took a different direction on this in Newton after dansmith reviewed it. Is it worth highlighting any of that in the commit message or somewhere in the spec?","commit_id":"f307e28cf6ede3cba738c8a4784c09861b1107f8"}],"specs/ocata/approved/websocket-proxy-to-host-security.rst":[{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"b7af0341a8ee7d4ee020922c58cb39ec846b91c3","unresolved":false,"context_lines":[{"line_number":154,"context_line":"python library, so there will be relatively low overhead."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Other deployer impact"},{"line_number":157,"context_line":"---------------------"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"For VNC, a deployer will have to enable use of the \u0027vencrypt\u0027 authentication"},{"line_number":160,"context_line":"scheme. This will be done via a new \u0027vnc.auth_schemes\u0027 configuration parameter"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_b77b0fbd","line":157,"updated":"2016-09-27 13:30:52.000000000","message":"How much of this could be automated? Or at least automatically tested for sanity?\n\nFor instance, if tls_required was reported in the Service object, then when the proxy starts up it could see that it\u0027s tls_required status doesn\u0027t match that of the compute nodes, and WARN about which are in a mismatch state.","commit_id":"61dc833c572d34f456829312f3a60ebe4a7699c1"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"533b11e4f71d0cf715b937bf60ceb8e695e3b53e","unresolved":false,"context_lines":[{"line_number":154,"context_line":"python library, so there will be relatively low overhead."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Other deployer impact"},{"line_number":157,"context_line":"---------------------"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"For VNC, a deployer will have to enable use of the \u0027vencrypt\u0027 authentication"},{"line_number":160,"context_line":"scheme. This will be done via a new \u0027vnc.auth_schemes\u0027 configuration parameter"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_1de941b7","line":157,"in_reply_to":"5a8bc5a2_b77b0fbd","updated":"2016-09-27 14:12:24.000000000","message":"The main paint point for deployers is providing the actual certificates. The tls_required thing is a hardening job.\n\nUnfortunately I don\u0027t think  its entirely straightforward for Nova compute nodes to be able to report when TLS is required or not. The way libvirt enables TLS for SPICE/VNC, Nova isn\u0027t actually involved at all - nova merely requests SPICE/VNC, and libvirt decides whether to turn on TLS or not based on the libvirt global config setting. \n\nSo in the upgrade scenario, it is hard for Nova to know whether all running VMs on the host are using TLS yet - as it doesn\u0027t even know TLS is used or not.\n\nThat\u0027s a long winded way of saying I don\u0027t think we can report \u0027tls_required\u0027 via the Service object without having Nova poke around at things behind libvirt\u0027s back, and that\u0027s not something I\u0027d want us todo.","commit_id":"61dc833c572d34f456829312f3a60ebe4a7699c1"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"b7af0341a8ee7d4ee020922c58cb39ec846b91c3","unresolved":false,"context_lines":[{"line_number":273,"context_line":""},{"line_number":274,"context_line":"7. Modify tempest to perform blackbox testing of the remote"},{"line_number":275,"context_line":"   console service, to validate that its possible to succesfully"},{"line_number":276,"context_line":"   establish a console connection when TLS is enabled."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Dependencies"},{"line_number":279,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_d7141ba1","line":276,"updated":"2016-09-27 13:30:52.000000000","message":"I think there is also a documentation effort in the official docs somewhere, as there is a lot of complexity in getting this right.","commit_id":"61dc833c572d34f456829312f3a60ebe4a7699c1"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"533b11e4f71d0cf715b937bf60ceb8e695e3b53e","unresolved":false,"context_lines":[{"line_number":273,"context_line":""},{"line_number":274,"context_line":"7. Modify tempest to perform blackbox testing of the remote"},{"line_number":275,"context_line":"   console service, to validate that its possible to succesfully"},{"line_number":276,"context_line":"   establish a console connection when TLS is enabled."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Dependencies"},{"line_number":279,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_fd5655cc","line":276,"in_reply_to":"5a8bc5a2_d7141ba1","updated":"2016-09-27 14:12:24.000000000","message":"Yep, in whatever doc we use to describe nova deployment.","commit_id":"61dc833c572d34f456829312f3a60ebe4a7699c1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":30,"context_line":"network of an OpenStack deployment they can perform three attacks:"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"* Passive snooping of all traffic between the proxy and compute node."},{"line_number":33,"context_line":"  This could allow the attacker to identify key stokes associated with"},{"line_number":34,"context_line":"  tenant user passwords, or view sensitive information displayed on"},{"line_number":35,"context_line":"  the virtual desktop."},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_1d8937cb","line":33,"range":{"start_line":33,"start_character":48,"end_line":33,"end_character":54},"updated":"2016-10-10 20:06:02.000000000","message":"strokes","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":61,"context_line":"  and serial console by enabling the use of x509 certificates. The"},{"line_number":62,"context_line":"  proxy server will have to present its own certificate to the compute"},{"line_number":63,"context_line":"  node when connecting which will validate the certificate against its"},{"line_number":64,"context_line":"  permited whitelist. At time of writing SPICE does not have support"},{"line_number":65,"context_line":"  for validating client x509 certificates. If this is developed by"},{"line_number":66,"context_line":"  the SPICE maintainers, it will also be added to Nova."},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_bd676b24","line":64,"range":{"start_line":64,"start_character":2,"end_line":64,"end_character":10},"updated":"2016-10-10 20:06:02.000000000","message":"permitted","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Proposed change"},{"line_number":78,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"This blueprint would introduce a hooks into the websocket proxy classes"},{"line_number":81,"context_line":"to enable negotiation of security features such as TLS encryption, x509"},{"line_number":82,"context_line":"certificate validation and other authentication schemes. The hooks will"},{"line_number":83,"context_line":"be able to optionally perform protocol specific handshakes, and then"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_fd48038a","line":80,"range":{"start_line":80,"start_character":33,"end_line":80,"end_character":38},"updated":"2016-10-10 20:06:02.000000000","message":"hook\n\nAlso, \u0027hook\u0027 might be a bad name here given the negative connotation with nova.hooks. Maybe callback is better?","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":84,"context_line":"modify the socket between the proxy and compute node, replacing the"},{"line_number":85,"context_line":"default clear text socket with an TLS wrapped one, or equivalent."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The intention is to implemented the VeNCrypt authentication scheme for"},{"line_number":88,"context_line":"VNC, which requires providing a security proxy hook that can perform a"},{"line_number":89,"context_line":"basic RFB protocol handshake / negotiation."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_c0519210","line":87,"range":{"start_line":87,"start_character":20,"end_line":87,"end_character":31},"updated":"2016-10-10 20:06:02.000000000","message":"implement","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":103,"context_line":"  security would also imply that the remote tenant client is able to directly"},{"line_number":104,"context_line":"  see the x509 certificates associated with the compute nodes. This forces"},{"line_number":105,"context_line":"  the deployer to use the same x509 certificate authority for both connections"},{"line_number":106,"context_line":"  inside the cloud and on the public internet. From a managability point of"},{"line_number":107,"context_line":"  view it is highly desirable to have CA for the internal network completely"},{"line_number":108,"context_line":"  separate from the CA used for public tenant facing servers."},{"line_number":109,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_20688eba","line":106,"range":{"start_line":106,"start_character":54,"end_line":106,"end_character":66},"updated":"2016-10-10 20:06:02.000000000","message":"manageability","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":193,"context_line":""},{"line_number":194,"context_line":"   [spice]"},{"line_number":195,"context_line":"   tls_ca_certs \u003d /path/to/ca-cert-bundle.pem"},{"line_number":196,"context_line":"   tls_required \u003d \u003cboolean\u003e"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"Note SPICE does not currently make use of client certificates, so"},{"line_number":199,"context_line":"there is no equivalent to the \u0027vnc.client_cert\u0027 parameter."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_204b2e2d","line":196,"updated":"2016-10-10 20:06:02.000000000","message":"Hmm, could we avoid this boolean config option if we just base it on whether or spice.not tls_ca_certs is set or not?\n\n-- later --\n\nReading below, I guess this flag is just used for straddling mixed computes during upgrades to TLS?","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"d7039ccc23c6439d8c385c811c0c938dd5475e2b","unresolved":false,"context_lines":[{"line_number":193,"context_line":""},{"line_number":194,"context_line":"   [spice]"},{"line_number":195,"context_line":"   tls_ca_certs \u003d /path/to/ca-cert-bundle.pem"},{"line_number":196,"context_line":"   tls_required \u003d \u003cboolean\u003e"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"Note SPICE does not currently make use of client certificates, so"},{"line_number":199,"context_line":"there is no equivalent to the \u0027vnc.client_cert\u0027 parameter."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_228320ce","line":196,"in_reply_to":"fa6399be_204b2e2d","updated":"2016-10-11 08:56:08.000000000","message":"Yes, exactly - we need this attr to handle case where some compute nodes have TLS enabled and some don\u0027t. Setting tls_required\u003dfalse, allows a MITM downgrade-attack, so people will only want this during upgrade. Once all VMs on all compute nodes are using TLS, they\u0027ll want tls_reqiured\u003dTrue to prevent downgrade attacks. I should note this in the security section.","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":196,"context_line":"   tls_required \u003d \u003cboolean\u003e"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"Note SPICE does not currently make use of client certificates, so"},{"line_number":199,"context_line":"there is no equivalent to the \u0027vnc.client_cert\u0027 parameter."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"In addition there will be a requirements to configure the virtualization"},{"line_number":202,"context_line":"host to enable use of TLS with SPICE. For QEMU/KVM compute nodes this will"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_80523adc","line":199,"range":{"start_line":199,"start_character":35,"end_line":199,"end_character":46},"updated":"2016-10-10 20:06:02.000000000","message":"tls_client_cert","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":212,"context_line":"can be switched to \u0027True\u0027."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"For serial consoles, a deployer will have to enable use of TLS by providing"},{"line_number":215,"context_line":"a CA certificate bundle, and optionally a client certificate and kley"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":".. code::"},{"line_number":218,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_a0049ec6","line":215,"range":{"start_line":215,"start_character":65,"end_line":215,"end_character":69},"updated":"2016-10-10 20:06:02.000000000","message":"key","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":253,"context_line":"----------"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"1. Modify the websockets proxy base classes to add hooks that"},{"line_number":256,"context_line":"   subclasses can use to implementation encryption and"},{"line_number":257,"context_line":"   authentication."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"2. Create a framework for implementing VNC authentication"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_e0dcd648","line":256,"range":{"start_line":256,"start_character":25,"end_line":256,"end_character":39},"updated":"2016-10-10 20:06:02.000000000","message":"implement","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":260,"context_line":"   mechanisms."},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"3. Create a websockets proxy security driver that can perform"},{"line_number":263,"context_line":"   a VNC protocol negotiation, invoking the VNC authnetication"},{"line_number":264,"context_line":"   schemes at appropriate times."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"4. Modify the novncproxy server to enable the VNC security"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_a0b9feee","line":263,"range":{"start_line":263,"start_character":48,"end_line":263,"end_character":62},"updated":"2016-10-10 20:06:02.000000000","message":"authentication","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":273,"context_line":"   for compute nodes and security proxy nodes and enable TLS for"},{"line_number":274,"context_line":"   VNC and SPICE."},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"7. Modify tempest to perform blackbox testing of the remote"},{"line_number":277,"context_line":"   console service, to validate that its possible to succesfully"},{"line_number":278,"context_line":"   establish a console connection when TLS is enabled."},{"line_number":279,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_80c15a31","line":276,"updated":"2016-10-10 20:06:02.000000000","message":"https://review.openstack.org/#/c/343078/ might help you out here.","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":274,"context_line":"   VNC and SPICE."},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"7. Modify tempest to perform blackbox testing of the remote"},{"line_number":277,"context_line":"   console service, to validate that its possible to succesfully"},{"line_number":278,"context_line":"   establish a console connection when TLS is enabled."},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"8. Modify openstack-manuals content to describe the procedure"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_809cfa6a","line":277,"range":{"start_line":277,"start_character":53,"end_line":277,"end_character":64},"updated":"2016-10-10 20:06:02.000000000","message":"successfully","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":275,"context_line":""},{"line_number":276,"context_line":"7. Modify tempest to perform blackbox testing of the remote"},{"line_number":277,"context_line":"   console service, to validate that its possible to succesfully"},{"line_number":278,"context_line":"   establish a console connection when TLS is enabled."},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"8. Modify openstack-manuals content to describe the procedure"},{"line_number":281,"context_line":"   for deploying compute nodes and the console proxy servers"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_a0873e11","line":278,"range":{"start_line":278,"start_character":15,"end_line":278,"end_character":54},"updated":"2016-10-10 20:06:02.000000000","message":"The good news is clarkb has TLS enabled in the gate for ocata now.","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":284,"context_line":"Dependencies"},{"line_number":285,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"Support for the VNC and SPICE features is already available in all"},{"line_number":288,"context_line":"versions of QEMU and Libvirt that Nova supports."},{"line_number":289,"context_line":""},{"line_number":290,"context_line":"Support for the serial console TLS feature will require QEMU \u003e\u003d 2.6"},{"line_number":291,"context_line":"and a libvirt \u003e\u003d 2.2.0. Deployments which lack these versions will"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_c008b294","line":288,"range":{"start_line":287,"start_character":0,"end_line":288,"end_character":48},"updated":"2016-10-10 20:06:02.000000000","message":"So we should be OK to test this out with vnc in tempest in the gate?","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"d7039ccc23c6439d8c385c811c0c938dd5475e2b","unresolved":false,"context_lines":[{"line_number":284,"context_line":"Dependencies"},{"line_number":285,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"Support for the VNC and SPICE features is already available in all"},{"line_number":288,"context_line":"versions of QEMU and Libvirt that Nova supports."},{"line_number":289,"context_line":""},{"line_number":290,"context_line":"Support for the serial console TLS feature will require QEMU \u003e\u003d 2.6"},{"line_number":291,"context_line":"and a libvirt \u003e\u003d 2.2.0. Deployments which lack these versions will"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_e2dcc81a","line":288,"range":{"start_line":287,"start_character":0,"end_line":288,"end_character":48},"in_reply_to":"fa6399be_c008b294","updated":"2016-10-11 08:56:08.000000000","message":"Yes, should be just fine","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":295,"context_line":"Testing"},{"line_number":296,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"Tempest will be enhanced to validate the ability to open a"},{"line_number":299,"context_line":"remote console for VNC, SPICE and serial consoles."},{"line_number":300,"context_line":""},{"line_number":301,"context_line":"Documentation Impact"},{"line_number":302,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_804b1ab0","line":299,"range":{"start_line":298,"start_character":0,"end_line":299,"end_character":50},"updated":"2016-10-10 20:06:02.000000000","message":"Thinking out loud here, but dane-fichter has been working on a new CI job which runs with image signing/verification turned on.\n\nAs we talked about that, we also noted that barbican is not in the integrated gate, so anything we do with key management is just using a fake key manager. It also turns out that barbican\u0027s devstack plugin just enables barbican for in-tree functional tests, it doesn\u0027t configure the other services to use barbican for key management, so we don\u0027t actually have any end to end testing for that stack.\n\nSo we got talking about having an actual job that turns on all of the security-related things which aren\u0027t on by default, like barbican for key management, image signing and verification, and we could probably also roll VNC + TLS into that mix and we\u0027d have like a gate-tempest-dsvm-neutron-security job or something.","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"05d08a0bd7ab63a01f7a7c4bfbe8f8abde2e404e","unresolved":false,"context_lines":[{"line_number":316,"context_line":""},{"line_number":317,"context_line":"* SPICE TLS: http://www.spice-space.org/docs/spice_user_manual.pdf -- page 11"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"* libvirt TLS setup:"},{"line_number":320,"context_line":"  VNC: http://wiki.libvirt.org/page/VNCTLSSetup,"},{"line_number":321,"context_line":"  SPICE: http://people.freedesktop.org/~teuf/spice-doc/html/ch02s08.html"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_c0c0b2e3","line":319,"updated":"2016-10-10 20:06:02.000000000","message":"Have you talked to any of the other virt drivers about their ability to support any of this?\n\n1. vnc: http://docs.openstack.org/developer/nova/support-matrix.html#console_vnc - vmware and xenapi should hopefully be OK here.\n\n2. spice would just be libvirt\n\n3. serial console: everyone but ironic supports this, but they are working on https://review.openstack.org/#/c/328157/\n\n4. rdp is the odd duck given it\u0027s only hyper-v","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"d7039ccc23c6439d8c385c811c0c938dd5475e2b","unresolved":false,"context_lines":[{"line_number":316,"context_line":""},{"line_number":317,"context_line":"* SPICE TLS: http://www.spice-space.org/docs/spice_user_manual.pdf -- page 11"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"* libvirt TLS setup:"},{"line_number":320,"context_line":"  VNC: http://wiki.libvirt.org/page/VNCTLSSetup,"},{"line_number":321,"context_line":"  SPICE: http://people.freedesktop.org/~teuf/spice-doc/html/ch02s08.html"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_02361c03","line":319,"in_reply_to":"fa6399be_c0c0b2e3","updated":"2016-10-11 08:56:08.000000000","message":"VMware doesn\u0027t implement the TLS extension for VNC. While Xen uses QEMU and so could technically support it, I don\u0027t believe XenAPI exposes any way to turn the feature on.\n\nFor serial console, I don\u0027t believe any other hypervisor supports exposing their serial ports over TCP using TLS.\n\nRDP doesn\u0027t use any of these proxy services, so its not relevant.","commit_id":"87251403b0d45455b8544d62d3b67f55b3ea53ab"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"95d49efde334f443f192b0ddd8caae1cba4713cb","unresolved":false,"context_lines":[{"line_number":224,"context_line":"updated to enable TLS, the \u0027spice.tls_required\u0027 configuration parameter"},{"line_number":225,"context_line":"can be switched to \u0027True\u0027."},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"For serial consoles, a deployer will have to enable use of TLS by providing"},{"line_number":228,"context_line":"a CA certificate bundle, and optionally a client certificate and key"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":".. code::"},{"line_number":231,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_941d0312","line":228,"range":{"start_line":227,"start_character":0,"end_line":228,"end_character":68},"updated":"2016-10-11 11:59:02.000000000","message":"When live-migrating an instance from a virtualization host which has this configuration to another virtualization host which has *not*, do we cancel the live-migration? Is the existence of this configuration even detectable by Nova? I\u0027m worried to have a scenario where the console to an instance isn\u0027t accessible anymore after a successful live-migration.","commit_id":"c26bfbd11906784b466f1825f42a09e9977e8409"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"1ecd57c4d3bea3b401ef0ac30316ead02528c434","unresolved":false,"context_lines":[{"line_number":224,"context_line":"updated to enable TLS, the \u0027spice.tls_required\u0027 configuration parameter"},{"line_number":225,"context_line":"can be switched to \u0027True\u0027."},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"For serial consoles, a deployer will have to enable use of TLS by providing"},{"line_number":228,"context_line":"a CA certificate bundle, and optionally a client certificate and key"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":".. code::"},{"line_number":231,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_d937b3e1","line":228,"range":{"start_line":227,"start_character":0,"end_line":228,"end_character":68},"in_reply_to":"fa6399be_941d0312","updated":"2016-10-11 12:29:51.000000000","message":"This change does not require any guest XML updates by Nova - TLS is enabled for all guests via changes in /etc/libvirt/qemu.conf. As such you can trivially migrate back \u0026 forth between hosts with it enabled vs disabled and it doesn\u0027t impact nova at all.","commit_id":"c26bfbd11906784b466f1825f42a09e9977e8409"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"95d49efde334f443f192b0ddd8caae1cba4713cb","unresolved":false,"context_lines":[{"line_number":230,"context_line":".. code::"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"   [serial_console]"},{"line_number":233,"context_line":"   tls_ca_certs \u003d /path/to/ca-cert-bundle.pem"},{"line_number":234,"context_line":"   tls_client_cert \u003d /path/to/client-cert.pem"},{"line_number":235,"context_line":"   tls_client_key \u003d /path/to/client-key.pem"},{"line_number":236,"context_line":"   tls_required \u003d \u003cboolean\u003e"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"In addition there will be a requirements to configure the virtualization"},{"line_number":239,"context_line":"host to enable use of TLS with serial ports. For QEMU/KVM compute nodes"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_14d81353","line":236,"range":{"start_line":233,"start_character":0,"end_line":236,"end_character":27},"updated":"2016-10-11 11:59:02.000000000","message":"Will that make the config options \"ssl_only\", \"cert\" and \"web\" obsolete? They are currently used by the baseproxy:\n\nhttps://github.com/openstack/nova/blob/master/nova/cmd/baseproxy.py#L59-L65","commit_id":"c26bfbd11906784b466f1825f42a09e9977e8409"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"1ecd57c4d3bea3b401ef0ac30316ead02528c434","unresolved":false,"context_lines":[{"line_number":230,"context_line":".. code::"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"   [serial_console]"},{"line_number":233,"context_line":"   tls_ca_certs \u003d /path/to/ca-cert-bundle.pem"},{"line_number":234,"context_line":"   tls_client_cert \u003d /path/to/client-cert.pem"},{"line_number":235,"context_line":"   tls_client_key \u003d /path/to/client-key.pem"},{"line_number":236,"context_line":"   tls_required \u003d \u003cboolean\u003e"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"In addition there will be a requirements to configure the virtualization"},{"line_number":239,"context_line":"host to enable use of TLS with serial ports. For QEMU/KVM compute nodes"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_f9b9d72f","line":236,"range":{"start_line":233,"start_character":0,"end_line":236,"end_character":27},"in_reply_to":"fa6399be_14d81353","updated":"2016-10-11 12:29:51.000000000","message":"Those settings control the public internet facing HTTP service exposed by the proxy, to the tenant user (ie horizon console client)\n\nThis new stuff is about the internal network to the compute node. You don\u0027t want to require the same certs be used for the public vs internal facing services.","commit_id":"c26bfbd11906784b466f1825f42a09e9977e8409"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"95d49efde334f443f192b0ddd8caae1cba4713cb","unresolved":false,"context_lines":[{"line_number":287,"context_line":""},{"line_number":288,"context_line":"6. Modify devstack to enable it to generate suitable certificates"},{"line_number":289,"context_line":"   for compute nodes and security proxy nodes and enable TLS for"},{"line_number":290,"context_line":"   VNC and SPICE."},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"7. Modify tempest to perform blackbox testing of the remote"},{"line_number":293,"context_line":"   console service, to validate that its possible to successfully"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_14bf33d1","line":290,"range":{"start_line":290,"start_character":3,"end_line":290,"end_character":17},"updated":"2016-10-11 11:59:02.000000000","message":"\"and serial console\" I guess?","commit_id":"c26bfbd11906784b466f1825f42a09e9977e8409"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"c69a990e93d0c876effb575ac6770b0a6a240adf","unresolved":false,"context_lines":[{"line_number":84,"context_line":"modify the socket between the proxy and compute node, replacing the"},{"line_number":85,"context_line":"default clear text socket with an TLS wrapped one, or equivalent."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The intention is to implemented the VeNCrypt authentication scheme for"},{"line_number":88,"context_line":"VNC, which requires providing a security proxy hook that can perform a"},{"line_number":89,"context_line":"basic RFB protocol handshake / negotiation."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_d1c4f860","line":87,"range":{"start_line":87,"start_character":20,"end_line":87,"end_character":31},"updated":"2016-10-17 21:02:24.000000000","message":"\"implement\"","commit_id":"8a03bd4d3f44a1015e4f7387256452708a22b01a"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"c69a990e93d0c876effb575ac6770b0a6a240adf","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The intention is to implemented the VeNCrypt authentication scheme for"},{"line_number":88,"context_line":"VNC, which requires providing a security proxy hook that can perform a"},{"line_number":89,"context_line":"basic RFB protocol handshake / negotiation."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"For SPICE and serial consoles, it is sufficient to simply replace the"},{"line_number":92,"context_line":"default clear text socket with a TLS wrapped one. It is not immediately"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_f161fc12","line":89,"updated":"2016-10-17 21:02:24.000000000","message":"I\u0027m a little confused about this bit. Is this purely to avoid the vnc client (novnc) from using the same cert it uses for nova-api to authenticate the compute node? I.e. to get in te middle of the client and the compute node to separate the x509 domains required for certificate auth? Seems like that\u0027s going to be different for VNC and SPICE based on what you say here.\n\nSo, not that it\u0027s a problem, but I think I\u0027m confused about this detail.","commit_id":"8a03bd4d3f44a1015e4f7387256452708a22b01a"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"bb5d861873f0642878bd1349edb22df6349f8558","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The intention is to implemented the VeNCrypt authentication scheme for"},{"line_number":88,"context_line":"VNC, which requires providing a security proxy hook that can perform a"},{"line_number":89,"context_line":"basic RFB protocol handshake / negotiation."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"For SPICE and serial consoles, it is sufficient to simply replace the"},{"line_number":92,"context_line":"default clear text socket with a TLS wrapped one. It is not immediately"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_25c5dc5a","line":89,"in_reply_to":"fa6399be_f161fc12","updated":"2016-10-18 09:37:31.000000000","message":"There are several reasons.\n\nFirst the in browser websockets client can only perform a TLS handshake at initial opening of the raw socket. VNC\u0027s VeNCrypt extension requires you to open the raw socket, start the VNC protocol, negotiate use of VeNCrypt and *then* start the TLS handshake, before continuing with the rest of the VNC protocol.\n\nSecond, for mutual auth, the compute nodes will want to mandate that the client (aka console server) provide a certificate during the handshake. This would not be possible if we were doing end-to-end TLS from the tenant user browse client \u003c-\u003e compute node. Hence, we need separate TLS connections tenant \u003c-\u003e console server, and console server \u003c-\u003e compute node.\n\nThird, the tenant client will be validating the hostname certificate provided by the console server during the TLS handshake. If we had end to end TLS from tenant \u003c-\u003e compute node, we would have to setup the same x509 server cert on every compute, which would complicate having multiple console servers deployed for horizontal scaling.\n\nSo there\u0027s multiple reasons why we want separate TLS connections between tenant \u003c-\u003e console server and console server \u003c-\u003e compute node.\n\nThe first reason doesn\u0027t apply to spice, since it runs TLS immediately, but the other two reasons do still apply. Hence, we deal with spice in the same way, and have separate TLS connections with console server in the middle","commit_id":"8a03bd4d3f44a1015e4f7387256452708a22b01a"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"c69a990e93d0c876effb575ac6770b0a6a240adf","unresolved":false,"context_lines":[{"line_number":306,"context_line":""},{"line_number":307,"context_line":"Support for the VNC and SPICE features is already available in all"},{"line_number":308,"context_line":"versions of QEMU and Libvirt that Nova supports, and it is thus"},{"line_number":309,"context_line":"already possible to test it with currently gate CI nodes."},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"Support for the serial console TLS feature will require QEMU \u003e\u003d 2.6"},{"line_number":312,"context_line":"and a libvirt \u003e\u003d 2.2.0. Deployments which lack these versions will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_9178c02d","line":309,"range":{"start_line":309,"start_character":33,"end_line":309,"end_character":42},"updated":"2016-10-17 21:02:24.000000000","message":"\"current\"","commit_id":"8a03bd4d3f44a1015e4f7387256452708a22b01a"}]}