From 0f3670dff57aa18567b1a03f0c02b46a65514afb Mon Sep 17 00:00:00 2001 From: Jan Kunzmann Date: Thu, 23 May 2019 13:03:18 +0200 Subject: [PATCH] Access cloud IP detection service via HTTPS --- src/modules/discovery/hosts.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/modules/discovery/hosts.py b/src/modules/discovery/hosts.py index 3dce185..38d213d 100644 --- a/src/modules/discovery/hosts.py +++ b/src/modules/discovery/hosts.py @@ -55,7 +55,12 @@ class HostDiscoveryHelpers: def get_cloud(host): try: logging.debug("Checking whether the cluster is deployed on azure's cloud") - metadata = requests.get("http://www.azurespeed.com/api/region?ipOrUrl={ip}".format(ip=host)).text + # azurespeed.com provide their API via HTTP only; the service can be queried with + # HTTPS, but doesn't show a proper certificate. Since no encryption is worse then + # any encryption, we go with the verify=false option for the time being. At least + # this prevents leaking internal IP addresses to passive eavesdropping. + # TODO: find a more secure service to detect cloud IPs + metadata = requests.get("https://www.azurespeed.com/api/region?ipOrUrl={ip}".format(ip=host), verify=False).text except requests.ConnectionError as e: logging.info("- unable to check cloud: {0}".format(e)) return