virsh power driver shouldn't allow passing in extra parameters

Bug #1815136 reported by Newell Jensen
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MAAS
Fix Released
High
Newell Jensen

Bug Description

Currently, with the Virsh power driver a user can add extra parameters to the user provided URL such as the 'command' parameter which would allow a user to execute any script/command on the rack controller as the maas user.

Virsh power parameters should most likely be just the IP address, username, and password (optional) and MAAS would construct the appropriate URL from this.

Related branches

Changed in maas:
status: Triaged → In Progress
Changed in maas:
status: In Progress → Fix Committed
Changed in maas:
milestone: 2.6.0 → 2.6.0alpha1
milestone: 2.6.0alpha1 → 2.6.0alpha2
Changed in maas:
status: Fix Committed → Fix Released
Revision history for this message
Mark Darmadi (darmadoo) wrote :

Hi there,

I am aware of this change and have been trying to work around it.

whenever I do not assign a hostname to VMWare, running this command:
virsh -c esx://root@<vmware_IP> list --all
will output:

error: failed to connect to the hypervisor
error: internal error: curl_easy_perform() returned an error: SSL peer certificate or SSH remote key was not OK (51) : SSL: certificate subject name (<vmware_IP>) does not match target host name '<vmware_IP>'

I then generated SSL certs and exchanged them between the MAAS servers and VMWare until I am able to list the VMs using:
virsh -c esx://root@<vmware_hostname> list --all

Now the problem is that when I try to add them through MAAS, using: esx://root@<vmware_hostname>,
MAAS does not read the hostname and translate them properly, this is the error message:

[info] BMC could not save extracted IP address '<vmware_hostname>': 'failed to detect a valid IP address from '<vmware_hostname>''

Since this has just been recently, there's not alot of resources for this fix. I hope someone here can help!

Revision history for this message
Newell Jensen (newell-jensen) wrote :

Mark,

Please file a separate bug for the issue you have reported above as I believe this is unrelated wo what you are hitting. From the looks of it, the code that verifies the hostname/IP is most likely causing issues here.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.