Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use nil ca_certs to trust system CAs #63

Merged
merged 1 commit into from
Jul 19, 2017
Merged

Use nil ca_certs to trust system CAs #63

merged 1 commit into from
Jul 19, 2017

Conversation

jhernand
Copy link
Contributor

@jhernand jhernand commented Jul 17, 2017 •
edited
Loading

Currently when the user sets the TLS certification validation switch to
"Yes" and does not provide a custom CA certificate, the provider doesn't
trust the system CA certificates, it trust no certificates at all
instead. This isn't the intended behaviour. To address that issue this
patch changes the provider so that it sets the 'ca_certs' parameter to
'nil' in this case. That 'nil' value indicates to both the 'ovirt' and
'ovirt-engine-sdk' gems that the system CA certificates should be
trusted.

Note that when using version 4 of the API and the 'ovirt-engine-sdk'
gem, the system CA certificates are loaded only once, when the gem is
loaded. If any CA certificate is added to the system, then the affected
ManageIQ workers will need to be reloaded. The affected workers are all
the provider workers and the UI worker. It may be more convenient to
just restart the appliances.

The complete sequence to verify this is the following:

  1. Get the CA certificate used by the oVirt system. If it is a
    self-signed certificate it will be available in the 'ca.pem' file
    inside the '/etc/pki/ovirt-engine' directory:
# scp ovirt.example.com:/etc/pki/ovirt-engine/ca.pem .
  1. Add the CA certificate to the directory containing the CA
    certificates that are added to the system database:
# cp ca.pem /etc/pki/ca-trust/source/anchors/ovirt.example.com.pem
  1. Update the system database:
# udpate-ca-trust

  1. At this point the database is updated, but it won't be reloaded if
    using version 4 of the API and the 'ovirt-engine-sdk' gem, so restart
    the appliance.

  2. Check that the authentication verification works setting TLS
    certificate validation to 'Yes', but without pasting any certificate
    in the text box for trusted CA certificates.

By default the provider uses version 3 of the API, make check this with
version 3 of the API and also with version 4, changing the settings to
do so:

:ems:
  :ems_redhat:
    :use_ovirt_engine_sdk: true

This patch addresses the following bug:

RHV provider does not trust certificate authorities from the system CA database
https://bugzilla.redhat.com/1459569

@jhernand
Copy link
Contributor Author

@masayag @borod108 @pkliczewski please review.

@jhernand
Copy link
Contributor Author

Bug 1459569 - RHV provider does not trust certificate authorities from the system CA database

@borod108
Copy link
Contributor

Why are the CA's loaded only once when using the ovirt-engine-sdk?

@jhernand
Copy link
Contributor Author

Because the ovirt-engine-sdk gem uses libcurl for all the HTTP details. That library is initialized once,when the SDK is required the first time, and it loads the system trusted certificates when it is initialized. I didn't find a way to force libcurl to re-load the system trusted certificate without restarting the Ruby process.

@jhernand
Copy link
Contributor Author

jhernand commented Jul 17, 2017 •
edited
Loading

Note that this applies only to the system trusted certificates, not to the certificates passed in the ca_certs parameters. Those, the certificates in ca_certs, are always honoured and trusted, by both the ovirt and ovirt-engine-sdk gems.

@jhernand
Use nil ca_certs to trust system CAs
481f70f 
Currently when the user sets the TLS certification validation switch to
"Yes" and does not provide a custom CA certificate, the provider doesn't
trust the system CA certificates, it trust no certificates at all
instead. This isn't the intended behaviour. To address that issue this
patch changes the provider so that it sets the 'ca_certs' parameter to
'nil' in this case. That 'nil' value indicates to both the 'ovirt' and
'ovirt-engine-sdk' gems that the system CA certificates should be
trusted.

Note that when using version 4 of the API and the 'ovirt-engine-sdk'
gem, the system CA certificates are loaded only once, when the gem is
loaded. If any CA certificate is added to the system, then the affected
ManageIQ workers will need to be reloaded. The affected workers are all
the provider workers and the UI worker. It may be more convenient to
just restart the appliances.

The complete sequence to verify this is the following:

1. Get the CA certificate used by the oVirt system. If it is a
   self-signed certificate it will be available in the 'ca.pem' file
   inside the '/etc/pki/ovirt-engine' directory:

   # scp ovirt.example.com:/etc/pki/ovirt-engine/ca.pem .

2. Add the CA certificate to the directory containing the CA
   certificates that are added to the system database:

   # cp ca.pem /etc/pki/ca-trust/source/anchors/ovirt.example.com.pem

3. Update the system database:

   # udpate-ca-trust

4. At this point the database is updated, but it won't be reloaded if
   using version 4 of the API and the 'ovirt-engine-sdk' gem, so restart
   the appliance.

5. Check that the authentication verification works setting TLS
   certificate validation to 'Yes', but without pasting any certificate
   in the text box for trusted CA certificates.

By default the provider uses version 3 of the API, make check this with
version 3 of the API and also with version 4, changing the settings to
do so:

  :ems:
  :ems_redhat:
    :use_ovirt_engine_sdk: true

This patch addresses the following bug:

  RHV provider does not trust certificate authorities from the system CA database
  https://bugzilla.redhat.com/1459569

Signed-off-by: Juan Hernandez <[email protected]>
@miq-bot
Copy link
Member

miq-bot commented Jul 19, 2017

Checked commit https://github.com/jhernand/manageiq-providers-ovirt/commit/481f70ff8d17fb65960b16aef614bcb0c075a946 with ruby 2.2.6, rubocop 0.47.1, and haml-lint 0.20.0
1 file checked, 0 offenses detected
Everything looks fine. 👍

@jhernand
Copy link
Contributor Author

@miq-bot add_label fine/yes

@masayag masayag merged commit 3c39291 into ManageIQ:master Jul 19, 2017
@simaishi
Copy link
Contributor

simaishi commented Aug 4, 2017

Fine backport (to manageiq repo) details:

$ git log -1
commit bb075a7eae1ac08c093c45b6364b26fe39e1b5d7
Author: Moti Asayag <[email protected]>
Date:   Wed Jul 19 12:48:21 2017 +0300

    Merge pull request #63 from jhernand/use_nil_ca_certs_to_trust_system_cas
    
    Use nil ca_certs to trust system CAs
    (cherry picked from commit 3c39291a97bb39ca9e196943f2eb1e28a4be002c)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1478560

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pkliczewski pkliczewski pkliczewski approved these changes

Assignees
No one assigned
Labels
fine/backported
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@jhernand @borod108 @miq-bot @simaishi @pkliczewski @masayag