Bug 1977699

Summary:	[pulp3] rhsm certguard failure messages are lost in log-level debug
Product:	Red Hat Satellite	Reporter:	Matthias Dellweg <mdellweg>
Component:	Pulp	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	POST ---	QA Contact:	Satellite QE Team <sat-qe-bz-list>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.10.0	CC:	dalley, dkliban, faguiard, ggainey, peter.vreman, rchan, ttereshc
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	pulp-certguard-1.5.8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1957813

Description Matthias Dellweg 2021-06-30 10:02:09 UTC

Description of problem:
When a client is denied access by the rhsm-certguard, the log messages describing the reason are lost with log level debug. They should be raised to at least warning, because they tell an administrator, why a client is unable to consume their subscriptions.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Subscribe a host to RH subscription content
2. Find a reason for the rhsm content guard to reject the client certificate
   Either https://bugzilla.redhat.com/show_bug.cgi?id=1977893,
   or misconfigure it, see below
3. On the host run `yum update` and observe that repodata.xml returns 403
4. In forman-tail observe that all reasons for ^ are in log level DEBUG

Actual results:


Expected results:
Failed authentication to subscription content should be logged at a higher level, maybe WARNING.


Additional info:

  Misconfiguring may be:
  `curl -vv -k -X PATCH  --data-urlencode 'ca_certificate' --cert /etc/pki/katello/certs/pulp-client.crt --key /etc/pki/katello/private/pulp-client.key "https://localhost/pulp/api/v3/contentguards/certguard/rhsm/<UUID>/"`

Comment 1 Brad Buckingham 2021-07-01 14:27:05 UTC

Hi Matthias, 

Can we provide a set of reproducer steps for QE to verify once a fix is available?  Thanks!

Comment 2 Grant Gainey 2021-07-02 12:28:17 UTC

I suspect this is a combination of https://github.com/pulp/pulp-certguard/blob/master/pulp_certguard/app/models.py#L42 and https://github.com/pulp/pulp-certguard/blob/master/pulp_certguard/app/models.py#L167-L169.

In the first, we only log "this doesn't even look like a cert" at debug-level.

In the second, we lose information on the specific error encountered and log "something went wrong".

Comment 3 Grant Gainey 2021-07-02 13:09:26 UTC

From discussion w/ Matthias:

certguard raises PermissionError, which is a base python error-class.  These error-messages appear to not show up in logging. Investigation needed on whether PermissionError is "special" in some way when it comes to being logged by the content-app.

NOTE: we really should not be overloadiung python's file-level PermissionError this way, and instead should have our own cecrtguard-perm-error. May want its own RFE.

See https://github.com/pulp/pulpcore/blob/master/pulpcore/content/handler.py#L296-L303 for where we might want to increase log-level.

Comment 4 Matthias Dellweg 2021-07-13 12:49:36 UTC

Provided the steps as part of the original comment.

Comment 5 pulp-infra@redhat.com 2021-07-26 08:09:10 UTC

The Pulp upstream bug status is at NEW. Updating the external tracker on this bug.

Comment 6 pulp-infra@redhat.com 2021-07-26 08:09:11 UTC

The Pulp upstream bug priority is at Normal. Updating the external tracker on this bug.

Comment 10 Robin Chan 2023-03-02 15:05:54 UTC

All upstream Pulp bugs are at MODIFIED+. Moving this bug to POST.