Secure KVM VNC Console Access Using the CA Framework #7015

nvazquez · 2022-12-22T04:28:05Z

Description

This PR allows securing the console access through CloudStack to the virtual machines running on KVM. The secure access is achieved through the generated certificates for the CA Framework in CloudStack, that provides mutual TLS connections between agents. These certificates are used to also secure the connection between the console proxies and the VNC ports for VM console access.

This feature is only supported on the KVM hypervisor

Design Document: https://cwiki.apache.org/confluence/display/CLOUDSTACK/Secure+KVM+VNC+connection+using+the+CA+framework

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Tested on KVM environment, enabling TLS on VNC

nvazquez · 2022-12-22T04:42:11Z

@blueorangutan package

blueorangutan · 2022-12-22T05:45:19Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 5053

codecov · 2022-12-22T07:01:03Z

Codecov Report

Merging #7015 (e75a69a) into main (c0a32d0) will increase coverage by 0.01%.
The diff coverage is 0.00%.

@@             Coverage Diff              @@
##               main    #7015      +/-   ##
============================================
+ Coverage     11.77%   11.78%   +0.01%     
- Complexity     7662     7665       +3     
============================================
  Files          2503     2505       +2     
  Lines        245958   246029      +71     
  Branches      38374    38382       +8     
============================================
+ Hits          28953    28986      +33     
- Misses       213240   213272      +32     
- Partials       3765     3771       +6

Impacted Files	Coverage Δ
...ava/com/cloud/servlet/ConsoleProxyClientParam.java	`0.00% <0.00%> (ø)`
...udstack/consoleproxy/ConsoleAccessManagerImpl.java	`5.21% <0.00%> (-0.34%)`	⬇️
...com/cloud/agent/manager/ConnectedAgentAttache.java	`25.00% <0.00%> (-12.50%)`	⬇️
...m/resource/wrapper/LibvirtReadyCommandWrapper.java	`61.53% <0.00%> (-11.19%)`	⬇️
...dstack/network/contrail/model/ModelObjectBase.java	`21.15% <0.00%> (-7.70%)`	⬇️
...n/java/com/cloud/storage/VolumeApiServiceImpl.java	`12.96% <0.00%> (-0.03%)`	⬇️
...oud/hypervisor/vmware/mo/HypervisorHostHelper.java	`15.54% <0.00%> (-0.02%)`	⬇️
...oud/hypervisor/vmware/resource/VmwareResource.java	`4.50% <0.00%> (-0.01%)`	⬇️
...m/cloud/hypervisor/vmware/mo/VirtualMachineMO.java	`0.93% <0.00%> (-0.01%)`	⬇️
... and 12 more

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

DaanHoogland

clggtm, just some remarks on structure and logging.
needs extensive testing though, might be good to have in 4.18

...console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyHttpHandlerHelper.java

services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyNoVncClient.java

services/console-proxy/server/src/main/java/com/cloud/consoleproxy/vnc/NoVncClient.java

.../console-proxy/server/src/main/java/com/cloud/consoleproxy/vnc/network/SSLEngineManager.java

DaanHoogland · 2022-12-22T08:37:56Z

...s/console-proxy/server/src/main/java/com/cloud/consoleproxy/vnc/security/VncTLSSecurity.java

+        if (manager == null) {
+            if (socketHandler.readUnsignedInteger(8) == 0) {
+                int result = socketHandler.readUnsignedInteger(32);
+                String reason;
+                if (result == RfbConstants.VNC_AUTH_FAILED || result == RfbConstants.VNC_AUTH_TOO_MANY) {
+                    reason = socketHandler.readString();
+                } else {
+                    reason = "Authentication failure (protocol error)";
+                }
+                throw new CloudRuntimeException(reason);
+            }
+            setParam();
+        }


move to a handleErrorState() type of method?

nvazquez · 2022-12-22T10:57:32Z

@blueorangutan package

blueorangutan · 2022-12-22T10:58:03Z

@nvazquez a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2022-12-22T11:56:22Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 5057

DaanHoogland · 2022-12-22T13:05:13Z

SonarCloud Quality Gate failed.

0 Bugs 0 Vulnerabilities 2 Security Hotspots 38 Code Smells

0.3% Coverage 0.4% Duplication

@nvazquez please go through these.

weizhouapache

overall code LGTM
left few minor comments

great job @nvazquez !
I'd learn these codes when I have time :-D

services/console-proxy/server/src/main/java/com/cloud/consoleproxy/vnc/NoVncClient.java

weizhouapache · 2022-12-22T13:12:35Z

systemvm/agent/noVNC/app/ui.js

@@ -471,22 +474,31 @@ const UI = {
        clearTimeout(UI.statusTimeout);

        switch (statusType) {
+            case 'encrypted':


we need to re-apply these changes when upgrade novnc.
not a big issue, just need to pay a bit more attention

nvazquez · 2022-12-22T14:22:56Z

@blueorangutan package

blueorangutan · 2022-12-22T14:24:03Z

@nvazquez a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

nvazquez · 2023-01-20T10:29:38Z

@blueorangutan package

blueorangutan · 2023-01-20T10:30:04Z

@nvazquez a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

sonarqubecloud · 2023-01-20T11:29:49Z

SonarCloud Quality Gate failed.

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.4% Coverage
0.5% Duplication

blueorangutan · 2023-01-20T11:35:05Z

Packaging result: ✖️ el7 ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 5340

nvazquez · 2023-01-20T11:37:12Z

@blueorangutan package

blueorangutan · 2023-01-20T11:38:03Z

@nvazquez a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2023-01-20T12:41:48Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 5347

DaanHoogland · 2023-01-20T13:09:29Z

@borisstoyanov , you approved based on manual testing, am i right?

DaanHoogland · 2023-01-20T14:28:56Z

@blueorangutan test

blueorangutan · 2023-01-20T14:30:03Z

@DaanHoogland a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

blueorangutan · 2023-01-21T03:03:45Z

Trillian test result (tid-5929)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 43845 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr7015-t5929-kvm-centos7.zip
Smoke tests completed. 106 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_08_upgrade_kubernetes_ha_cluster	`Failure`	567.45	test_kubernetes_clusters.py

rohityadavcloud · 2023-01-27T11:51:32Z

LGTM, tested this in an old env which is upgraded to this feature. The old VM (ssvm, cpvm, VR etc) had unencrypted vnc console; on stop/start they were shown as encrypted. I also tested the provisionCertificate API and read the documentation notes and cross-checked all requirements.

rohityadavcloud · 2023-01-27T11:51:47Z

Merging this based on review, testing and smoketests. cc @DaanHoogland

GutoVeronezi · 2023-01-30T00:58:01Z

Just for the record, I have tested both access (encrypted and unencrypted) and it is working fine:

with:
without:

Secure KVM VNC Console Access Using the CA Framework

0081dc2

nvazquez added component:kvm component:console-proxy type:security Severity:Major labels Dec 22, 2022

nvazquez requested review from rohityadavcloud, shwstppr, DaanHoogland, davidjumani, GutoVeronezi, slavkap and weizhouapache December 22, 2022 04:28

Add missing license header

697fd5a

Fix missing parameter

9d43897

apache deleted a comment from blueorangutan Dec 22, 2022

DaanHoogland approved these changes Dec 22, 2022

View reviewed changes

DaanHoogland added this to the 4.18.0.0 milestone Dec 22, 2022

Remove unused variable from the TLS security

9e90aa3

weizhouapache approved these changes Dec 22, 2022

View reviewed changes

Address review comments and sonar cloud reports

eda2a83

borisstoyanov approved these changes Jan 19, 2023

View reviewed changes

nvazquez marked this pull request as ready for review January 19, 2023 13:04

Update activity time when reading from socket

e75a69a

nvazquez marked this pull request as draft January 20, 2023 14:29

DaanHoogland assigned andrijapanicsb Jan 23, 2023

DaanHoogland requested a review from andrijapanicsb January 23, 2023 08:46

rohityadavcloud marked this pull request as ready for review January 27, 2023 10:19

rohityadavcloud approved these changes Jan 27, 2023

View reviewed changes

rohityadavcloud assigned rohityadavcloud and unassigned andrijapanicsb Jan 27, 2023

rohityadavcloud merged commit eac357c into apache:main Jan 27, 2023

rohityadavcloud deleted the kvm-secure-console-access branch January 27, 2023 11:52

nvazquez mentioned this pull request Feb 16, 2023

Fix console access on XCPng/Xen #7243

Merged

12 tasks

This was referenced Feb 24, 2023

Fix VNC SecurityType None on RFB v3.8 #7287

Merged

Add Secure KVM Console Access documentation apache/cloudstack-documentation#306

Merged

havengit mentioned this pull request Sep 23, 2024

VM console cannot access after VNC certificate expired #9718

Closed

Secure KVM VNC Console Access Using the CA Framework #7015

Secure KVM VNC Console Access Using the CA Framework #7015

Uh oh!

Conversation

nvazquez commented Dec 22, 2022

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Uh oh!

nvazquez commented Dec 22, 2022

Uh oh!

blueorangutan commented Dec 22, 2022

Uh oh!

codecov bot commented Dec 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DaanHoogland Dec 22, 2022

Choose a reason for hiding this comment

Uh oh!

nvazquez commented Dec 22, 2022

Uh oh!

blueorangutan commented Dec 22, 2022

Uh oh!

blueorangutan commented Dec 22, 2022

Uh oh!

DaanHoogland commented Dec 22, 2022

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

weizhouapache Dec 22, 2022

Choose a reason for hiding this comment

Uh oh!

nvazquez commented Dec 22, 2022

Uh oh!

blueorangutan commented Dec 22, 2022

Uh oh!

nvazquez commented Jan 20, 2023

Uh oh!

blueorangutan commented Jan 20, 2023

Uh oh!

sonarqubecloud bot commented Jan 20, 2023

Uh oh!

blueorangutan commented Jan 20, 2023

Uh oh!

nvazquez commented Jan 20, 2023

Uh oh!

blueorangutan commented Jan 20, 2023

Uh oh!

blueorangutan commented Jan 20, 2023

Uh oh!

DaanHoogland commented Jan 20, 2023

Uh oh!

DaanHoogland commented Jan 20, 2023

Uh oh!

blueorangutan commented Jan 20, 2023

Uh oh!

blueorangutan commented Jan 21, 2023

Uh oh!

codecov bot commented Dec 22, 2022 •

edited

Loading