Fix CA generation as non-root user due to .rnd error #929
Conversation
BrooklynDewolf
requested review from
ahadas,
bennyz,
emesika,
mwperina,
michalskrivanek,
oliel,
sgratch,
smelamud,
didib and
ljelinkova
as code owners
BrooklynDewolf
force-pushed
the
fix/OV-17
branch
4 times, most recently
from
a70829c to
99fe131
Compare
BrooklynDewolf
changed the title
|
/ost |
|
Sorry, I do not understand the problem this should fix, nor what caused it to surface suddenly. Is it a change in openssl (genpkey or req)? In theory, moving the 'cd ' outside of the subshell starting in line 88 is significant - affects also e.g. keytool. |
|
I think that developer mode did work at least at some point after this code was written (~ 11 years ago, based on the git log). I also searched and found now something I wrote many years ago and never get to actually publishing. Might be useful, so putting in a separate comment. |
How to use ovirt-engine's CA scripts to run a separate CAThe scripts were not designed to allow this, but do not have too many hard-coded paths either. So it's not hard to make them use a different directory. To create your own copyMYCADIR=$HOME/testca FQDN="my-ca-common-name.example.org" mkdir -p "${MYCADIR}" "${MYPKIDIR}" "${MYBINDIR}" cp /usr/share/ovirt-engine/bin/pki-* "${MYBINDIR}" cd "${MYPKIDIR}" Note that this is usually done by engine-setup, and we might do other replacements in the future. But currently AIA is enough.for f in cert.template cacert.template; do sed "s#@aia@#${AIA}#" < "${f}.in" > "${f}"; done mkdir certs keys private requests To create your CA there"${MYBINDIR}"/pki-create-ca.sh --subject="${CA_SUBJECT}" --keystore-password="${PKIPASS}" To create local keyThis creates a temp key, csr, signs it, packs into a pkcs12 archive, and removes the temp key. N is the prefix of used files, DN is the domain name for which we do this: N=name1; DN=myname1.example.org; "${MYBINDIR}"/pki-enroll-pkcs12.sh --name="${N}" --password="${PKIPASS}" --subject="/C=US/O=eng.lab.tlv.redhat.com/CN=${DN}" --san="DNS:${DN}" To extract the key to its own file without a password: N=name1; "${MYBINDIR}"/pki-pkcs12-extract.sh --name="${N}" --passin="${PKIPASS}" --key="${MYPKIDIR}/keys/${N}".key.nopass To create the key and csr outside of the CA, and sign in the CASomewhere: openssl genrsa -out my-thing.key 2048 openssl req -new -out my-thing.csr -key my-thing.key Copy the csr to the CA, e.g. if on same machine: cp my-thing.csr "${MYPKIDIR}"/requests/name2.req Then, to sign, on the CA machine: N=name2; DN=myname2.example.org; "${MYBINDIR}"/pki-enroll-request.sh --name=${N} --subject="/C=US/O=myorg.redhat.com/CN=${DN}" --san="DNS:${DN}" Your generated certs are in $MYPKIDIR/certs , in both cases. To put everything where [1] expects themcp ca.pem /tmp/3rd-party-ca-cert.pem |
|
Considering the reference to RHV 4.2 docs, I suppose I tested it at the time and it worked. No idea about later versions. |
|
Thanks for the review @didib The issue only occurs when you run engine-setup as a non-root user. The openssl req command fails: Is executed AT_FDCWD (which is not changed by the script), and in that folder openssl tries to find the .rnd file. So it will try to create one, which fails, cause it does not have permissions on the current CWD: This can be properly fixed by changing the CWD before running the openssl req command. |
|
I do not object to merging. The purpose is not completely clear. I suggest to document this properly. If it makes sense to fit into the commit message, please do. If it's part of a larger project, perhaps link to a relevant document. Generally speaking, engine-setup supports only one of:
For engine-setup, the condition for deciding what mode you are in is simply based on the UID. If it's root, no question. Otherwise, we ask, and abort if user does not ack. packaging/setup/plugins/ovirt-engine-common/base/core/misc.py . It seems like you are trying to do something in between. Right? I suspect it will require some more work. In principle, developer-mode can work also on non-RPM systems - I know of someone in the distant past using it on gentoo. [1] https://www.ovirt.org/develop/developer-guide/engine/engine-development-environment.html |
|
@didib : We are creating a docker development container to be able to build/test oVirt on any local machine if it has docker :) |
engine-setup fails creating the CA certificate when running under non-root user with the following error:
---------
plugin.execute:923 execute-output: ('/home/build/**FILTERED**//share/**FILTERED**-engine/bin/pki-create-ca.sh', '--subject=/C=US/O=Test/CN=c0714690d92b.71630', '--keystore-password=**FILTERED**', '--ca-file=ca') stderr:
Can't load .rnd into RNG
803BCAC12B7F0000:error:12000079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:106:Filename=.rnd
Cannot write random bytes:
803BCAC12B7F0000:error:12000079:random number generator:RAND_write_file:Cannot open file:crypto/rand/randfile.c:240:Filename=.rnd
Cannot generate CA request
----------
openssl commands try to find a .rnd file in the current directly. If not found, it will be created.
But as we do not change early enough into the correct path, the .rnd file can't be created there, resulting in an error.
So we just switch move the openssl req command in the subshell in the correct PKIDIR path.
Signed-off-by: Brooklyn Dewolf <[email protected]>
Signed-off-by: Jean-Louis Dupond <[email protected]>
|
No code change, just fix Signed-off-by :) |
|
/ost |
|
Merging based on previous approvals |
Changes introduced with this PR
Are you the owner of the code you are sending in, or do you have permission of the owner?
Yes
Co-authored-by: Jean-Louis Dupond [email protected]
Signed-off-by: Brooklyn Dewolf [email protected]