{"action":"opened","issue":{"url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/3663","repository_url":"https://api.github.com/repos/ansible/ansible-modules-extras","labels_url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/3663/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/3663/comments","events_url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/3663/events","html_url":"https://github.com/ansible/ansible-modules-extras/issues/3663","id":193545833,"number":3663,"title":"lxd_container does not validate HTTPS server certificate","user":{"login":"candlerb","id":44789,"avatar_url":"https://avatars.githubusercontent.com/u/44789?v=3","gravatar_id":"","url":"https://api.github.com/users/candlerb","html_url":"https://github.com/candlerb","followers_url":"https://api.github.com/users/candlerb/followers","following_url":"https://api.github.com/users/candlerb/following{/other_user}","gists_url":"https://api.github.com/users/candlerb/gists{/gist_id}","starred_url":"https://api.github.com/users/candlerb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/candlerb/subscriptions","organizations_url":"https://api.github.com/users/candlerb/orgs","repos_url":"https://api.github.com/users/candlerb/repos","events_url":"https://api.github.com/users/candlerb/events{/privacy}","received_events_url":"https://api.github.com/users/candlerb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-05T16:32:21Z","updated_at":"2016-12-05T16:32:21Z","closed_at":null,"body":"##### ISSUE TYPE\r\n\r\n - Bug Report\r\n\r\n##### COMPONENT NAME\r\n\r\nlxd_container\r\n\r\n##### ANSIBLE VERSION\r\n\r\n```\r\nansible 2.2.0.0\r\n  config file = /home/brian/ansible-configs/auth-servers/ansible.cfg\r\n  configured module search path = Default w/o overrides\r\n```\r\n\r\n##### CONFIGURATION\r\n\r\nN/A\r\n\r\n##### OS / ENVIRONMENT\r\n\r\nN/A\r\n\r\n##### SUMMARY\r\n\r\nlxd_container does not appear to validate server certificate when connecting via REST API to a remote host using HTTPS, and therefore seems to be using it insecurely.\r\n\r\n##### STEPS TO REPRODUCE\r\n\r\n```\r\n- hosts: localhost\r\n  tasks:\r\n    - name: create container\r\n      lxd_container:\r\n        url: https://192.168.5.82:8443\r\n        trust_password: XXXXXXXX\r\n        name: foo\r\n        state: started\r\n        source:\r\n          type: image\r\n          mode: pull\r\n          server: https://cloud-images.ubuntu.com/releases\r\n          protocol: simplestreams\r\n          alias: '16.04'\r\n```\r\n\r\n... where 192.168.5.82 is some remote lxd server which has remote access enabled using\r\n\r\n~~~\r\nlxc config set core.https_address \"[::]\"\r\nlxc config set core.trust_password XXXXXXXX\r\n~~~\r\n\r\nRemove trust password and repeat. ansible is happy to talk to the host again (it is caching its own client certificate). However it doesn't appear to have cached the server certificate anywhere, so has no way to confirm it is still talking to the same host.\r\n\r\n##### EXPECTED RESULTS\r\n\r\n* lxd_container module should require that the server certificate fingerprint is provided, or explicitly that no fingerprint check is to be done\r\n* even if no fingerprint check is done initially, the first time the connection is made to the server the server certificate is cached and used to validate subsequent connections\r\n\r\nThe 'lxc' command line tool does exactly this:\r\n\r\n* It shows the server certificate fingerprint and asks you to confirm it's OK (unless you pass `--accept-certificate`)\r\n* It creates `~/.config/lxc/servercerts/<remote>.crt` to cache the server certificate\r\n* If you remove this file, it complains that it can't validate the certificate\r\n\r\n~~~\r\nerror: Get https://192.168.5.82:8443/1.0/containers?recursion=1: x509: certificate signed by unknown authority\r\n~~~\r\n\r\n(Aside: until recently, lxd created certificates with \"DNS:192.168.5.82\" in the SubjectAltName. This has now been [fixed](https://github.com/lxc/lxd/issues/2457) so it has \"IP:192.168.5.82\". But you still need to accept the certificate since it's self-signed)\r\n\r\n##### ACTUAL RESULTS\r\n\r\nNo server certificate checking or caching appears to be taking place\r\n\r\n##### NOTES\r\n\r\nIn `lib/ansible/module_utils/lxd.py` the ssl context is created using:\r\n\r\n~~~\r\n            ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)\r\n~~~\r\n\r\nHowever according to the [documentation](https://docs.python.org/2/library/ssl.html) Purpose.CLIENT_AUTH is used for when you are building an SSL server. If you are connecting *to* an SSL server you are supposed to use Purpose.SERVER_AUTH.\r\n\r\n(But it's not entirely clear to me what the 'purpose' is doing. It does say that \"Passing SERVER_AUTH as purpose sets verify_mode to CERT_REQUIRED\" and loads CA certificates. But in this case we may wish to validate the server certificate *and* present a client certificate to the server)"}}
{"actor":{"display_login":"candlerb"}}