Migrate the HTTP Store to Use Requests¶
https://blueprints.launchpad.net/glance/+spec/http-store-on-requests
Currently, the glance_store
uses httplib
to talk to the backing HTTP
Store. In the case where the store is served over plain-text (http://
)
this isn’t an issue. In the event that the store is served over TLS
(https://
) then the connection was not verified by httplib
. In
order to provide verification of the connection on all versions of Python,
glance_store
is moving to use Requests.
Problem description¶
Currently, the glance_store
uses httplib
to talk to the backing HTTP
Store. In the case where the store is served over plain-text (http://
)
this isn’t an issue. In the event that the store is served over TLS
(https://
) then the connection was not verified by httplib
[1].
If an operator is serving their store over HTTPS, they may be expecting Glance
to verify the connection when downloading the image which is not the case.
At the moment, when Glance downloads an image from the backing store, it does
not verify the checksum. If an attacker can properly position themselves, they
can intercept the connection by providing a fake (a.k.a., spoofed) certificate.
This allows the attacker to essentially perform a denial of service attack by
providing bad image data on the behalf of the store. This assumes that the
service consuming Glance’s images validates the checksum provided by Glance in
the Content-MD5
header. (This also assumes the attacker cannot change that
value in the database or before the header reaches the service making the
request.) If an attacker is properly positioned, they can also easily perform
surveillance of the system, even if they choose not to poison the data.
Further, the attacker could monitor Glance long enough to generate a malicious image with the appropriate checksum (since it is currently MD5 which is no longer cryptographically secure and is increasingly easy to create a collision [2] [3] [4]).
Proposed change¶
In order to provide verification of the connection on all versions of Python,
glance_store
should use Requests. A refactor has already taken place, but
in order to provide proper backwards compatibility the HTTP Store needs new
configuration options.
Users will need:
A way to disable HTTPS Verification
This spec proposes naming that option
disable_https_verification
.A way to provide a certificate bundle for verification
This spec proposes naming that option
https_ca_bundle
.A way to provide proxy information
This spec proposes naming that option
http_proxy_information
.
In order to reduce the impact on upgrades, this spec proposes defaulting the
new disable_https_verification
option to True
with logged warnings
that it will be changing to False
by default in the next cycle. There will
be an accompanying OpenStack Security Note (OSSN) written for this case.
Alternatives¶
The Encrypted and Authenticated Image Support specification might seem to be an alternative but that merely secures the image data, it does not secure the transport.
Data model impact¶
None
REST API impact¶
None
Security impact¶
This will improve the security of the system.
Notifications impact¶
None
Other end user impact¶
If the HTTP Store’s certificate expires, users will be unable to download images.
Performance Impact¶
By using sessions in Requests, multiple requests will be faster due to Requests implementation of connection pooling.
Other deployer impact¶
Deployers using self-signed certificates for their HTTP Store will need to
provide the certificate as part of a bundle to be used by glance_store
for
verification.
Developer impact¶
None
Implementation¶
Assignee(s)¶
- Primary assignee:
icordasc
- Other contributors:
None
Reviewers¶
- Core reviewer(s):
nikhil-komawar flaper87
- Other reviewer(s):
sabari
Work Items¶
Re-factor the HTTP Store to use Requests
Add configuration options and documentation described above
Write and publish an OSSN
Dependencies¶
None
Testing¶
Unit tests should be added to the glance_store
library to ensure that
operators can disable verification or provide their own bundle.
Documentation Impact¶
New configuration options will be added and explained.