Bug 1257886
| Summary: | Need trust anchor thing while using remote-viewer connect to .vv file to see foreign menu | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | zhoujunqin <juzhou> |
| Component: | virt-viewer | Assignee: | Default Assignee for SPICE Bugs <rh-spice-bugs> |
| Status: | CLOSED WONTFIX | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.0 | CC: | cfergeau, dblechte, djasa, elima, fziglio, jjongsma, michal.skrivanek, mxie, mzhan, rbalakri, tzheng, victortoso, xiaodwan |
| Target Milestone: | rc | Flags: | knoel:
mirror+
|
| Target Release: | 8.1 | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-07-09 19:05:55 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1682781 | ||
| Bug Blocks: | |||
|
Description
zhoujunqin
2015-08-28 10:23:58 UTC
This bug a slim chance for good solution so we're probably left with:
- good error message in virt-viewer
- a good documentation explaining what's needed
Let me explain:
The root cause is RHEV API cert is neither trusted system-wide, nor specified system wide. The issue is complicated however because the certificate used for web can be and frequently is issued by different CA than RHEV CA - and RHEV doesn't have powers to ensure that the CA is even known to RHEV. This is caused by usual CA chain in TLS:
RootCA (trusted) [- intermediateCA_1 [- intermediateCA_n]] - webCertificate
The root CA
- is expected to be included in client system (in ca certificates or among
trust anchors)
- is not expected to be included in CA chain
So in configuration with no intermediate CAs, the root CA cert may not even be included in RHEV-M system (in case it is some internal CA) so the only thing that engine can supply to the client is the web cert itself.
To make things more complicated, the TLS in RHEV is provided by apache and what RHEV does is merely a default configuration so getting the web certificate in use is not exactly an easy task to solve (well, by default, reading it from ssl.conf should be enough in most setups - but the only reliable way is to connect to apache and read the cert from ServerHello).
On client side, libsoup - glib's http library used for libgovirt networking - would need to support to add RHEV-M cert as trusted one. I have no idea if it has such a capability
If these two issues are resolved in satisfactory way, then it should be possible to add the web certificate to a new item in vv file [ovirt] section and have libgovirt use it. The room for things not working as expected would however still remain large so the question is if it is worth the hassle.
Current state is that: - if SPICE CA and web CA are the same, then 'trust anchor' needs to be used - if SPICE CA and web CA are not the same, then 'trust anchor' needs to be used The easy fix to #1 so that 'trust anchor' is not needed breaks #2 with no possible workaround, which is not so nice :( No good solution in sight for 7.3 I'm afraid, moving to 7.4... Looking at this again, librest could detect the invalid CA in _call_message_completed_cb by using soup_message_get_https_status() and then report an error to the upper layer (libgovirt in our case). We could then show some error dialog to the user saying the certificate is invalid, and let it override this. Needs some work in librest first, not el7 material. Resetting devel_ack+ as this needs to be prioritized first. |