Re: [RFC qemu-server 1/4] remote migrate: drop ineffective fingerprint auto-detection

[Fiona Ebner <f.ebner@proxmox.com>]

Forgot to CC Fabian, doing it now :)

Am 29.07.26 um 11:57 AM schrieb Fiona Ebner:
> Am 21.07.26 um 1:58 PM schrieb Erik Fastermann:
>> When no fingerprint was supplied, the code fetched the remote node
>> certificate and pinned its fingerprint for the migration tunnel. This
>> has no functional effect and is removed.
>>
>> That fetch only succeeds for remotes trusted via the CA store, which
>> is exactly the case where pinning is unnecessary: both the API client
>> and the websocket tunnel fall back to CA verification on their own.
>> For a self-signed remote the fetch itself fails verification, so no
>> fingerprint is ever obtained.
> 
> The websocket tunnel checks the pinned fingerprint against the one that
> was supplied, so with the current code any weird scenario where the
> fingerprint queried from the certificates API endpoint does not match
> the one gotten later by the websocket tunnel connection is caught. If
> you remove the pinning, such scenarios won't be caught anymore. Not sure
> how important that is though.
> 
> @Fabian what do you think?
> 
>>
>> The only meaningful path, an explicitly supplied fingerprint (needed to
>> verify self-signed remotes), is unchanged.
>>
>> Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
>> ---
>>  src/PVE/API2/Qemu.pm | 16 ++--------------
>>  1 file changed, 2 insertions(+), 14 deletions(-)
>>
>> diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
>> index 28cbb9b0..68f1800c 100644
>> --- a/src/PVE/API2/Qemu.pm
>> +++ b/src/PVE/API2/Qemu.pm
>> @@ -5739,26 +5739,14 @@ __PACKAGE__->register_method({
>>              apitoken => $remote->{apitoken},
>>          };
>>  
>> -        my $fp;
>> -        if ($fp = $remote->{fingerprint}) {
>> -            $conn_args->{cached_fingerprints} = { uc($fp) => 1 };
>> +        if ($remote->{fingerprint}) {
>> +            $conn_args->{cached_fingerprints} = { uc($remote->{fingerprint}) => 1 };
>>          }
>>  
>>          print "Establishing API connection with remote at '$remote->{host}'\n";
>>  
>>          my $api_client = PVE::APIClient::LWP->new(%$conn_args);
>>  
>> -        if (!defined($fp)) {
>> -            my $cert_info = $api_client->get("/nodes/localhost/certificates/info");
>> -            foreach my $cert (@$cert_info) {
>> -                my $filename = $cert->{filename};
>> -                next if $filename ne 'pveproxy-ssl.pem' && $filename ne 'pve-ssl.pem';
>> -                $fp = $cert->{fingerprint} if !$fp || $filename eq 'pveproxy-ssl.pem';
>> -            }
>> -            $conn_args->{cached_fingerprints} = { uc($fp) => 1 }
>> -                if defined($fp);
>> -        }
>> -
>>          my $repl_conf = PVE::ReplicationConfig->new();
>>          my $is_replicated = $repl_conf->check_for_existing_jobs($source_vmid, 1);
>>          die "cannot remote-migrate replicated VM\n" if $is_replicated;
> 
> 
> 
> 
>