Bug 1118468
| Summary: | [RFE] Add the ability to poll on FETCH_ROOT | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Keenan Brock <kbrock> | ||||||
| Component: | certmonger | Assignee: | Nalin Dahyabhai <nalin> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Kaleem <ksiddiqu> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | 6.6 | CC: | dpal, kchamart, nsoman, salmy | ||||||
| Target Milestone: | rc | Keywords: | FutureFeature | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | certmonger-0.75.8-1.el6 | Doc Type: | Enhancement | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2014-10-14 07:12:47 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 923256 [details]
extract from /var/log/message
I see only POLL operation in every 10 seconds in /var/log/message and not the FETCH_ROOT operation every 10 seconds.
is this expected or i missed something in setup?
Able to see the FETCH_ROOTS with custom CA helper "sample" when no cert request is placed. Above attachement observed after placing the cert request. [root@rhel66-master ~]# cat /var/log/messages|grep FETCH-ROOTS Aug 1 18:06:53 rhel66-master samplehelper[26287]: FETCH-ROOTS -> wait Aug 1 18:07:03 rhel66-master samplehelper[26322]: FETCH-ROOTS -> wait Aug 1 18:07:13 rhel66-master samplehelper[26325]: FETCH-ROOTS -> wait Aug 1 18:07:23 rhel66-master samplehelper[26328]: FETCH-ROOTS -> wait Aug 1 18:07:33 rhel66-master samplehelper[26331]: FETCH-ROOTS -> wait Aug 1 18:07:43 rhel66-master samplehelper[26333]: FETCH-ROOTS -> wait Aug 1 18:07:53 rhel66-master samplehelper[26335]: FETCH-ROOTS -> wait Aug 1 18:08:03 rhel66-master samplehelper[26339]: FETCH-ROOTS -> wait Aug 1 18:08:13 rhel66-master samplehelper[26341]: FETCH-ROOTS -> wait Aug 1 18:08:24 rhel66-master samplehelper[26343]: FETCH-ROOTS -> wait Aug 1 18:08:34 rhel66-master samplehelper[26346]: FETCH-ROOTS -> wait Aug 1 18:08:44 rhel66-master samplehelper[26348]: FETCH-ROOTS -> wait Aug 1 18:08:54 rhel66-master samplehelper[26351]: FETCH-ROOTS -> wait Aug 1 18:09:04 rhel66-master samplehelper[26354]: FETCH-ROOTS -> wait Aug 1 18:09:14 rhel66-master samplehelper[26357]: FETCH-ROOTS -> wait Aug 1 18:09:24 rhel66-master samplehelper[26359]: FETCH-ROOTS -> wait Aug 1 18:09:34 rhel66-master samplehelper[26365]: FETCH-ROOTS -> wait Aug 1 18:09:44 rhel66-master samplehelper[26369]: FETCH-ROOTS -> wait Aug 1 18:09:54 rhel66-master samplehelper[26372]: FETCH-ROOTS -> wait Aug 1 18:10:04 rhel66-master samplehelper[26381]: FETCH-ROOTS -> wait Aug 1 18:10:14 rhel66-master samplehelper[26383]: FETCH-ROOTS -> wait Aug 1 18:10:24 rhel66-master samplehelper[26385]: FETCH-ROOTS -> wait Aug 1 18:10:34 rhel66-master samplehelper[26387]: FETCH-ROOTS -> wait Aug 1 18:10:44 rhel66-master samplehelper[26389]: FETCH-ROOTS -> wait Aug 1 18:10:54 rhel66-master samplehelper[26391]: FETCH-ROOTS -> wait Aug 1 18:11:04 rhel66-master samplehelper[26394]: FETCH-ROOTS -> wait Aug 1 18:11:14 rhel66-master samplehelper[26396]: FETCH-ROOTS -> wait Aug 1 18:11:24 rhel66-master samplehelper[26399]: FETCH-ROOTS -> wait Aug 1 18:11:34 rhel66-master samplehelper[26401]: FETCH-ROOTS -> wait [root@rhel66-master ~]# (In reply to Kaleem from comment #4) > Able to see the FETCH_ROOTS with custom CA helper "sample" when no cert > request is placed. > > Above attachement observed after placing the cert request. > > [root@rhel66-master ~]# cat /var/log/messages|grep FETCH-ROOTS > Aug 1 18:06:53 rhel66-master samplehelper[26287]: FETCH-ROOTS -> wait I'm not sure what you mean here, and whether what you're observing is what we're expecting or not. Can you elaborate? (In reply to Nalin Dahyabhai from comment #5) > (In reply to Kaleem from comment #4) > > Able to see the FETCH_ROOTS with custom CA helper "sample" when no cert > > request is placed. > > > > Above attachement observed after placing the cert request. > > > > [root@rhel66-master ~]# cat /var/log/messages|grep FETCH-ROOTS > > Aug 1 18:06:53 rhel66-master samplehelper[26287]: FETCH-ROOTS -> wait > > I'm not sure what you mean here, and whether what you're observing is what > we're expecting or not. Can you elaborate? As per description, when we place a cert request, "FETCH-ROOTS" should be logged in every 10 seconds but i observe that "POLL" string is logged when i place a cert request. FETCH-ROOTS is logged when certmonger restarted with new SAMPLE CA helper and without placing the cert request. Both can happen concurrently, since the daemon's able to run them in parallel. It'll always poll for root certificates, independently of whether or not there's an enrollment request pending. Yes both are happening concurrently.Turning to verified state. certmonger version: ================== [root@rhel66-master ~]# rpm -q certmonger certmonger-0.75.9-1.el6.x86_64 [root@rhel66-master ~]# snip from /var/log/message : ============================ Aug 5 17:26:17 rhel66-master samplehelper[6710]: SUBMIT[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:26:26 rhel66-master samplehelper[6712]: FETCH-ROOTS -> wait Aug 5 17:26:27 rhel66-master samplehelper[6714]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:26:36 rhel66-master samplehelper[6716]: FETCH-ROOTS -> wait Aug 5 17:26:37 rhel66-master samplehelper[6718]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:26:46 rhel66-master samplehelper[6720]: FETCH-ROOTS -> wait Aug 5 17:26:47 rhel66-master samplehelper[6722]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:26:56 rhel66-master samplehelper[6724]: FETCH-ROOTS -> wait Aug 5 17:26:57 rhel66-master samplehelper[6726]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:27:06 rhel66-master samplehelper[6729]: FETCH-ROOTS -> wait Aug 5 17:27:07 rhel66-master samplehelper[6731]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:27:16 rhel66-master samplehelper[6733]: FETCH-ROOTS -> wait Aug 5 17:27:17 rhel66-master samplehelper[6735]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:27:26 rhel66-master samplehelper[6737]: FETCH-ROOTS -> wait Aug 5 17:27:27 rhel66-master samplehelper[6739]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:27:36 rhel66-master samplehelper[6742]: FETCH-ROOTS -> wait Aug 5 17:27:37 rhel66-master samplehelper[6744]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:27:46 rhel66-master samplehelper[6746]: FETCH-ROOTS -> wait Aug 5 17:27:47 rhel66-master samplehelper[6748]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:27:56 rhel66-master samplehelper[6750]: FETCH-ROOTS -> wait Aug 5 17:27:57 rhel66-master samplehelper[6752]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:28:06 rhel66-master samplehelper[6754]: FETCH-ROOTS -> wait Aug 5 17:28:07 rhel66-master samplehelper[6756]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Aug 5 17:28:16 rhel66-master samplehelper[6759]: FETCH-ROOTS -> wait Aug 5 17:28:17 rhel66-master samplehelper[6761]: POLL[cb07e48c27baccc1116c79dd43b6146f08f85d58] -> wait Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1512.html |
Created attachment 917166 [details] sample-helper.rb Description of problem: When certmonger calls a ca helper with `CERTMONGER_OPERATION="FETCH-ROOT"`, the root is not always available. If the helper exists with a "wait status" (exit 1 or exit 5), it will not be called again. I would like certmonger to respect the exit status and call again in the future. Version-Release number of selected component (if applicable): Running against the nightly build certmonger-0.75.6-0.20140626T1401Zgit2887f37.el6.x86_64 Issue present in all current versions. How reproducible: Always Steps to Reproduce: 1. yum install -y ruby 1. cp sample-helper.rb /usr/libexec/certmonger/sample-helper.rb 2. cp sample-definition /var/lib/certmonger/cas/sample-definition 3. getcert request -c sample -v -f sample.crt -F sample-root.crt -k sample.key 4. tail -f /var/log/messages | grep samplehelper Actual results: only outputs FETCH-ROOTS once Expected results: outputs FETCH-ROOTS every 10 seconds Additional info: my sample-definition file looks like the following (could only upload one): id=sample ca_is_default=0 ca_type=EXTERNAL ca_external_helper=/usr/libexec/certmonger/sample-helper.rb