Re: [RFC qemu-server 1/4] remote migrate: drop ineffective fingerprint auto-detection

[Fiona Ebner <f.ebner@proxmox.com>]

Am 21.07.26 um 1:58 PM schrieb Erik Fastermann:
> When no fingerprint was supplied, the code fetched the remote node
> certificate and pinned its fingerprint for the migration tunnel. This
> has no functional effect and is removed.
> 
> That fetch only succeeds for remotes trusted via the CA store, which
> is exactly the case where pinning is unnecessary: both the API client
> and the websocket tunnel fall back to CA verification on their own.
> For a self-signed remote the fetch itself fails verification, so no
> fingerprint is ever obtained.

The websocket tunnel checks the pinned fingerprint against the one that
was supplied, so with the current code any weird scenario where the
fingerprint queried from the certificates API endpoint does not match
the one gotten later by the websocket tunnel connection is caught. If
you remove the pinning, such scenarios won't be caught anymore. Not sure
how important that is though.

@Fabian what do you think?

> 
> The only meaningful path, an explicitly supplied fingerprint (needed to
> verify self-signed remotes), is unchanged.
> 
> Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
> ---
>  src/PVE/API2/Qemu.pm | 16 ++--------------
>  1 file changed, 2 insertions(+), 14 deletions(-)
> 
> diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
> index 28cbb9b0..68f1800c 100644
> --- a/src/PVE/API2/Qemu.pm
> +++ b/src/PVE/API2/Qemu.pm
> @@ -5739,26 +5739,14 @@ __PACKAGE__->register_method({
>              apitoken => $remote->{apitoken},
>          };
>  
> -        my $fp;
> -        if ($fp = $remote->{fingerprint}) {
> -            $conn_args->{cached_fingerprints} = { uc($fp) => 1 };
> +        if ($remote->{fingerprint}) {
> +            $conn_args->{cached_fingerprints} = { uc($remote->{fingerprint}) => 1 };
>          }
>  
>          print "Establishing API connection with remote at '$remote->{host}'\n";
>  
>          my $api_client = PVE::APIClient::LWP->new(%$conn_args);
>  
> -        if (!defined($fp)) {
> -            my $cert_info = $api_client->get("/nodes/localhost/certificates/info");
> -            foreach my $cert (@$cert_info) {
> -                my $filename = $cert->{filename};
> -                next if $filename ne 'pveproxy-ssl.pem' && $filename ne 'pve-ssl.pem';
> -                $fp = $cert->{fingerprint} if !$fp || $filename eq 'pveproxy-ssl.pem';
> -            }
> -            $conn_args->{cached_fingerprints} = { uc($fp) => 1 }
> -                if defined($fp);
> -        }
> -
>          my $repl_conf = PVE::ReplicationConfig->new();
>          my $is_replicated = $repl_conf->check_for_existing_jobs($source_vmid, 1);
>          die "cannot remote-migrate replicated VM\n" if $is_replicated;