Bug 1242310
| Summary: | published repositories give 403 forbidden when attempting to navigate to the https address | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Nagoor Shaik <nshaik> | ||||
| Component: | Capsule | Assignee: | Alex Wood <awood> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Katello QA List <katello-qa-list> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 6.0.8 | CC: | aathomas, achadha, adahms, aheslin, awood, bbuckingham, bkearney, brubisch, dlezzoum, ehelms, ftsiadim, fvzwieten, hartsjc, jkachuck, jsherril, katello-bugs, katello-qa-list, mmccune, mmello, rbobek, rplevka, sthirugn, suprabhu, xdmoon | ||||
| Target Milestone: | Unspecified | Keywords: | Triaged | ||||
| Target Release: | Unused | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: |
Previously, published repositories returned a 403 Forbidden status. With this release, repositories that are published as SSL-protected can be accessed using the debug certificate for an organization.
|
Story Points: | --- | ||||
| Clone Of: | 1128870 | ||||||
| : | 1320179 1351648 (view as bug list) | Environment: | |||||
| Last Closed: | 2016-07-27 11:06:18 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1128870 | ||||||
| Bug Blocks: | 1115190, 1320179, 1351648 | ||||||
| Attachments: |
|
||||||
|
Description
Nagoor Shaik
2015-07-13 02:13:24 UTC
Since this issue was entered in Red Hat Bugzilla, the release flag has been set to ? to ensure that it is properly evaluated for this release. Created attachment 1081327 [details]
Cert Downloaded from Satellite 6.1.3
May I allow IBM access to this BZ? Thank You Joe Kachuck BZ is now public. After chatting with the candlepin team, this seems like it may be a bug in m2crypto. I wrote a small python script https://gist.github.com/jlsherrill/ad4e9a7122c08e6a7436 to test a particular cert and the uber certs seem to fail. Al's analysis indicates that certs with an expiration date after 2050 fail to validate in m2crypto. Filed upstream bug with M2Crypto at https://gitlab.com/m2crypto/m2crypto/issues/103 However, python-rhsm only uses M2Crypto to read version 1 entitlement certificates. Version 3 entitlement certificates are read via a C extension. The same problem exists in that extension as well (GeneralizedTimes being interpreted as UTCTimes). See https://github.com/candlepin/python-rhsm/blob/d437f96f0aa3311f4b9b21a5fd128825ecc52f72/src/certificate.c#L447 The fastest fix is to path Candlepin to not issue certificates with an expiration date past 2050. Upstream bug component is Capsule Upstream bug assigned to jomitsch Unlinked from upstream issue as the problem is being resolved in candlepin Based on testing with Satellite 6.2 Beta Snap 9.x, this appears to have been solved. I am going to move it ON_QA for verification. VERIFIED on Sat 6.2.0 Beta Snap GA10.1 The repo listing now works just fine with using the Org certificate: $ curl -s -k --cert ~/Downloads/Default\ Organization-key-cert.pem https://intel-canoepass-11.lab.bos.redhat.com/pulp/repos/Default_Organization/Library/content/dist/rhel/server/6/6.7/x86_64/os | head -n20 <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Pulp Repository Index</title> </head> <body> <h1>Pulp Repository Content</h1> <a href="../">Parent Directory</a> <ul style='list-style: none outside none; font-family: monospace'> <li><a href="repodata/">repodata/</a></li> <li><a href="389-ds-base-1.2.10.2-15.el6.x86_64.rpm">389-ds-base-1.2.10.2-15.el6.x86_64.rpm</a></li> <li><a href="389-ds-base-1.2.10.2-18.el6_3.x86_64.rpm">389-ds-base-1.2.10.2-18.el6_3.x86_64.rpm</a></li> Still failing after updating my Sat 6.1 to Sat 6.2 beta 2 release. $ curl -s -k --cert ~/Downloads/PUB-key-cert.pem https://sat6.pub.com/pulp/repos/Org-Pub/Library/content/dist/rhel/server/7/7Server/x86_64/os | head -n 20 <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Internal Server Error</title> </head> <body> <h1>HTTP 500: Internal server error.</h1> <p>An unexpected error occurred while handling your request.</p> </body> </html> Same error when using web-browser too. (In reply to James Hartsock from comment #18) > Still failing after updating my Sat 6.1 to Sat 6.2 beta 2 release. > > $ curl -s -k --cert ~/Downloads/PUB-key-cert.pem > https://sat6.pub.com/pulp/repos/Org-Pub/Library/content/dist/rhel/server/7/ > 7Server/x86_64/os | head -n 20 > > <!DOCTYPE html> > <html lang="en"> > <head> > <meta charset="UTF-8"> > <title>Internal Server Error</title> > </head> > <body> > <h1>HTTP 500: Internal server error.</h1> > <p>An unexpected error occurred while handling your request.</p> > </body> > </html> > > > Same error when using web-browser too. Hi James, that looks like a different issue as you're getting ISE (500) instead of Access Forbidden (403). Could you check your server logs to find out what went wrong? (/var/log/foreman/production.log + httpd logs (ssl_error.log, etc.)) Roman, There is a 403 for the request in var/log/httpd/foreman-ssl_access_ssl.log ~~~ 172.31.0.40 - - [18/Jul/2016:09:32:47 -0500] "GET /pulp/repos/Org-Pub/Library/content/dist/rhel/server/7/7Server/x86_64/os HTTP/1.1" 403 303 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36" 172.31.0.40 - 2c9f809451549b3a015154a55d580009 [18/Jul/2016:09:32:47 -0500] "GET /pulp/repos/Org-Pub/Library/content/dist/rhel/server/7/7Server/x86_64/os HTTP/1.1" 500 254 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36" 172.31.0.20 - admin [18/Jul/2016:09:32:51 -0500] "GET /pulp/api/v2/tasks/5ff18de6-9e69-4d0b-865f-f2b16f3b7c31/ HTTP/1.1" 200 328 "-" "Ruby" ~~~ var/log/httpd/foreman-ssl_error_ssl.log ~~ [Mon Jul 18 09:32:47.893845 2016] [ssl:error] [pid 2488] [client 172.31.0.40:49056] AH02261: Re-negotiation handshake failed: Not accepted by client!? ~~~ (In reply to James Hartsock from comment #20) > Roman, > > There is a 403 for the request in var/log/httpd/foreman-ssl_access_ssl.log > ~~~ > 172.31.0.40 - - [18/Jul/2016:09:32:47 -0500] "GET > /pulp/repos/Org-Pub/Library/content/dist/rhel/server/7/7Server/x86_64/os > HTTP/1.1" 403 303 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 > (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36" > > 172.31.0.40 - 2c9f809451549b3a015154a55d580009 [18/Jul/2016:09:32:47 -0500] > "GET > /pulp/repos/Org-Pub/Library/content/dist/rhel/server/7/7Server/x86_64/os > HTTP/1.1" 500 254 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 > (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36" > > 172.31.0.20 - admin [18/Jul/2016:09:32:51 -0500] "GET > /pulp/api/v2/tasks/5ff18de6-9e69-4d0b-865f-f2b16f3b7c31/ HTTP/1.1" 200 328 > "-" "Ruby" > ~~~ > > var/log/httpd/foreman-ssl_error_ssl.log > ~~ > [Mon Jul 18 09:32:47.893845 2016] [ssl:error] [pid 2488] [client > 172.31.0.40:49056] AH02261: Re-negotiation handshake failed: Not accepted by > client!? > ~~~ Sorry James, got a satellite upgraded from 6.1.9 to recent beta snap and it works just fine. (for the web browser, i needed to follow these steps in order to convert the certificate to supported format: http://www.katello.org/troubleshooting/debug_certificate.html) If you have a reproducer steps, I'd suggest you to open a new BZ. $ sed -n '/-----BEGIN RSA PRIVATE KEY-----/,/-----END RSA PRIVATE KEY-----/p' PUB-key-cert.pem > key.pem $ sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' PUB-key-cert.pem > cert.pem $ openssl pkcs12 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -export -in cert.pem -inkey key.pem -out sat6.pfx v openssl pkcs12 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -export -in cert.pem -inkey key.pem -out sat6.pfx -name sat6.pub.com Enter Export Password: Verifying - Enter Export Password: chrome://settings/certificates import -> ~/Downloads/sat6.pfx Still fails for me, but if working for others fine. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2016:1501 qe_test_coverage PR: https://github.com/SatelliteQE/robottelo/pull/5672 |