Bug 1598331
| Summary: | Puppet 3 on Ruby 1.8.7 (RHEL6) doesn't represent an array as ["1.0", "1.1"] but 1.01.1 | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Michal Dekan <mdekan> | ||||
| Component: | Installation | Assignee: | satellite6-bugs <satellite6-bugs> | ||||
| Status: | CLOSED WONTFIX | QA Contact: | Katello QA List <katello-qa-list> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 6.2.15 | CC: | rjerrido, stbenjam | ||||
| Target Milestone: | Unspecified | ||||||
| Target Release: | Unused | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2018-07-05 14:46:49 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Michal Dekan
2018-07-05 07:09:16 UTC
Ruby 1.8.7 is rather unintelligent in how in converts a YAML array to strings: irb(main):007:0> yaml['foreman_proxy::plugin::dynflow::tls_disabled_versions'].to_s => "1.01.1" To fix this bug permanently we would need to change how the puppet module handles the dynflow template to look like foreman proxy: https://github.com/theforeman/puppet-foreman_proxy/blob/master/templates/settings.yml.erb#L46-L53 ** WORKAROUND ** For Dynflow you can use this as a workaround for now: foreman_proxy::plugin::dynflow::tls_disabled_versions: ["['1.0', '1.1']"] Given the fact that - 6.2 is not the latest release of Satellite at this time, so short of extremely high severity bugs we are not adding new capabilities there. - this issue specifically affects _only_ RHEL6 - There is a sufficient workaround in comment #2 - The customer can (and should) upgrade to RHEL 6.3 Closing this BZ as WONTFIX. Please create a KCS article with the above workaround. The other issue is that Ruby 1.8.7 doesn't include the masks for disabling TLS v1.1. These are defined in the OpenSSL header files, and pulled in by the ruby library. See: https://github.com/ruby/ruby/blob/ruby_1_8_7/ext/openssl/ossl_ssl.c#L1474-L1476 We would need to monkey patch Ruby. Users should move to RHEL 7 at the least, and ideally Satellite 6.3 as soon as possible. The other issue is that Ruby 1.8.7 doesn't include the masks for disabling TLS v1.1. These are defined in the OpenSSL header files, and pulled in by the ruby library. See: https://github.com/ruby/ruby/blob/ruby_1_8_7/ext/openssl/ossl_ssl.c#L1474-L1476 We would need to monkey patch Ruby. Users should move to RHEL 7 at the least, and ideally Satellite 6.3 as soon as possible. (In reply to Rich Jerrido from comment #3) > Given the fact that > > - 6.2 is not the latest release of Satellite at this time, so short of > extremely high severity bugs we are not adding new capabilities there. > - this issue specifically affects _only_ RHEL6 > - There is a sufficient workaround in comment #2 > - The customer can (and should) upgrade to RHEL 6.3 > > Closing this BZ as WONTFIX. Please create a KCS article with the above > workaround. Updated current https://access.redhat.com/solutions/26833 with this workaround for Satellite 6.2.15 running on RHEL6. |