Bug 1444903

Summary:	AH02261: Re-negotiation handshake failed
Product:	Red Hat Enterprise Linux 7	Reporter:	Jeff Ortel <jortel>
Component:	ostree	Assignee:	Colin Walters <walters>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	lfriedma, mnguyen
Target Milestone:	rc	Keywords:	Extras
Target Release:	7.4
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-10-19 15:17:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jeff Ortel 2017-04-24 14:12:43 UTC

Description of problem:

SSL using client certificate works with curl but not with ostree.

CURL:

curl -v -k --cert ./ostree-crt-key.pem
<HOST>/pulp/ostree/web/Default_Organization/Dev/atomic_cv/content/dist/rhel/atomic/7/7Server/x86_64/ostree/repo/summary


OSTREE:

[root@qe-capsule-upgrade-rhel7 ostree]# cat config
[core]
repo_version=1
mode=archive-z2

[remote "satellite"]
url=<HOST>/pulp/ostree/web/Default_Organization/Dev/atomic_cv/content/dist/rhel/atomic/7/7Server/x86_64/ostree/repo
tls-permissive=true
tls-client-cert-path=/root/ostree-crt-key.pem
tls-client-key-path=/root/ostree-crt-key.pem
[root@qe-capsule-upgrade-rhel7 ostree]# ostree remote refs --repo=.
satellite
error: Error performing TLS handshake: A TLS fatal alert has been
received.


On Satellite: AH02261: Re-negotiation handshake failed: Not accepted by
client!?

Both <HOST> and certificates supplied in private comment.


Version-Release number of selected component (if applicable):

ostree-2017.1-2.atomic.el7.x86_64
libsoup-2.48.1-6.el7.x86_64


How reproducible:

Always.


Steps to Reproduce:
1. Create repository.
2. Create remote using attached certificate.
3. 

Actual results:

AH02261: Re-negotiation handshake failed

Expected results:

No error.

Additional info:

Comment 2 Jeff Ortel 2017-04-24 14:23:35 UTC

The remote is a Satellite.  Here is the apache configuration:

[root@qe-capsule-upgrade-rhel7 ~]# cat /etc/httpd/conf.d/pulp_ostree.conf 
#
# Apache configuration file for Pulp's OSTree support
#
RedirectMatch "^/pulp/ostree/web/(.*?)/repodata/(.*)"  "/pulp/repos/$1/repodata/$2"
RedirectMatch "^/pulp/ostree/web/(.*?)\.rpm"  "/pulp/repos/$1.rpm"

# -- HTTPS Repositories ---------

Alias /pulp/ostree /var/www/pub/ostree/

<Directory /var/www/pub/ostree>
    WSGIAccessScript /usr/share/pulp/wsgi/repo_auth.wsgi
    SSLRequireSSL
    SSLVerifyClient require
    SSLVerifyDepth 2
    SSLOptions +StdEnvVars +ExportCertData +FakeBasicAuth
    Options FollowSymLinks Indexes
</Directory>

Comment 9 Colin Walters 2017-07-13 18:47:58 UTC

There are libsoup/glib-networking bugs in this area; see e.g. https://bugzilla.gnome.org/show_bug.cgi?id=781578

In Fedora 26+, we have switched ostree to libcurl (matching NetworkManager), and libcurl in Fedora uses OpenSSL.  It's possible this will be backported to RHEL at some point.

Comment 10 Colin Walters 2017-07-13 19:09:57 UTC

We just confirmed actually that `--with-curl` to ostree-2017.7-2 in RHEL works.
Doesn't tell us whether or not the bug is in ostree's libsoup code, libsoup/glib-networking, or gnutls, but I suspect libsoup/glib-networking.

Comment 11 Nikos Mavrogiannopoulos 2017-07-14 05:53:50 UTC

I'm not sure if the two issues are related but I'd move the bug there to be addressed. Even if ostree moves its back-end, the issue would remain.

Comment 14 errata-xmlrpc 2017-10-19 15:17:43 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2952