Menu

#7 Add SSL support

1.0
open
nobody
None
2011-10-25
2011-10-05
No

I'm attaching a patch that seems to play along with encrypted virtual serial port connections. This seems to work well enough on our installation, but there are a few points that should be considered before incorporating it into vSPC.py.

First, I haven't tested it on a system without openssl. The documentation for the ssl module suggests that the presence of the ssl module is dependent on the presence of openssl, so importing ssl like in the patch could cause problems on systems without openssl. A patched vSPC.py should be tested on a system without openssl so we can figure out how/if that import fails and work around it gracefully.

Second, the wrapped socket will raise an SSLError when asked to work with inappropriate certificates and keys; usually, in my experience, when listener.accept is called in new_vm_connection. Such exceptions are caught by the top-level exception handler and the program stopped. Do we want to explore less conservative reactions to those errors?

Finally, this patch makes vSPC ignore certificates, if any are presented by the client. I don't know if the ESX hosts can be configured to present client certificates, but it would be nice to validate them if they are there; a man in the middle could gain sensitive information if allowed to eavesdrop on a virtual serial port connection.

1 Attachments

Discussion


Log in to post a comment.

MongoDB Logo MongoDB