OpenStack Compute (nova)

libvirt driver's to_xml method logs iscsi auth_password if debug

Bug #1319943 reported by Matt Riedemann
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
High
Matt Riedemann
OpenStack Compute (nova) 2014.2 "juno"
Icehouse
Fix Released
High
Yaguang Tang
OpenStack Compute (nova) 2014.1.2

Bug Description

If you have debug logging enabled the libvirt driver's to_xml method logs the iscsi auth_password in plain text.

Revision history for this message
Matt Riedemann (mriedem) wrote :

It's the block_device_info object that has the password getting logged.

tags: added: volume
Revision history for this message
Matt Riedemann (mriedem) wrote :

Patch is up: https://review.openstack.org/#/c/93787/

Changed in nova:
status: New → In Progress
assignee: nobody → Matt Riedemann (mriedem)
importance: Undecided → High
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (master)

Reviewed: https://review.openstack.org/93787
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=5dda3a6ab2becb5dd0b58c088f6daad807e12276
Submitter: Jenkins
Branch: master

commit 5dda3a6ab2becb5dd0b58c088f6daad807e12276
Author: Matt Riedemann <email address hidden>
Date: Thu May 15 12:22:19 2014 -0700

    Mask block_device_info auth_password in virt driver debug logs

    The block_device_info object can have an auth_password key which is
    getting logged at debug level in several virt drivers so we need to
    sanitize the message getting logged.

    Adds tests to ensure the logged messages are properly sanitized.

    Note that bug 1321785 was opened to track the long-term design issues
    with storing the password in the block_device_info dict since this can
    crop up elsewhere if it's logged. The immediate fix here is to mask
    what's already exposed.

    Closes-Bug: #1319943

    Change-Id: I0eae07ce3f0f39861eb97ec3dec44895386c7d04

Changed in nova:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in nova:
milestone: none → juno-1
status: Fix Committed → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (stable/icehouse)

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/99536

Yaguang Tang (heut2008)
tags: added: icehouse-backport-potential
Alan Pevec (apevec)
tags: removed: icehouse-backport-potential
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (stable/icehouse)

Reviewed: https://review.openstack.org/99536
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=14080812961e5a2f6a7054a45d2afa013e4f3899
Submitter: Jenkins
Branch: stable/icehouse

commit 14080812961e5a2f6a7054a45d2afa013e4f3899
Author: Matt Riedemann <email address hidden>
Date: Thu May 15 12:22:19 2014 -0700

    Mask block_device_info auth_password in virt driver debug logs

    The block_device_info object can have an auth_password key which is
    getting logged at debug level in several virt drivers so we need to
    sanitize the message getting logged.

    Adds tests to ensure the logged messages are properly sanitized.

    Note that bug 1321785 was opened to track the long-term design issues
    with storing the password in the block_device_info dict since this can
    crop up elsewhere if it's logged. The immediate fix here is to mask
    what's already exposed.

    Closes-Bug: #1319943

    (cherry picked from commit 5dda3a6ab2becb5dd0b58c088f6daad807e12276)

    Conflicts:
     nova/tests/virt/libvirt/test_libvirt.py
     nova/tests/virt/vmwareapi/test_vmops.py

    Change-Id: I0eae07ce3f0f39861eb97ec3dec44895386c7d04

Thierry Carrez (ttx)
Changed in nova:
milestone: juno-1 → 2014.2
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.