Bug 670274

Summary:	not verbose enough error message when subject-host differs from server
Product:	Red Hat Enterprise Linux 6	Reporter:	Alon Levy <alevy>
Component:	spice-client	Assignee:	Hans de Goede <hdegoede>
Status:	CLOSED ERRATA	QA Contact:	Desktop QE <desktop-qa-list>
Severity:	medium	Docs Contact:
Priority:	low
Version:	6.1	CC:	dblechte, hdegoede, mhasko, mkenneth, tcapek
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	spice-client-0.7.2-1.el6	Doc Type:	Bug Fix
Doc Text:	If the client failed verification because of a subject mismatch between the supplied host and the actual host, the error message given was too short to be useful. With this update, the error message is now sufficiently informative.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-05-19 13:15:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	671383

Description Alon Levy 2011-01-17 18:33:13 UTC

Description of problem:
If the client fails verification because of a subject mismatch between
supplied host and actual host, it laconicly says "SSL error 1" instead
of giving a better error message. Fix is ACKED upstream:

 http://lists.freedesktop.org/archives/spice-devel/2011-January/002205.html

 client: log subject-host mismatch, and raise ssl warnings to errors


Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. start qemu with secure channels, with subject $A != $B, some random string.
2. connect using --host-subject $B
  
Actual results:
look at $HOME/.spicec/spicec.log, it won't say "subject host differs", but just "SSL failed"


Expected results:
Should say subject host verification failed.

Additional info:

Comment 2 Hans de Goede 2011-01-25 13:52:01 UTC

A new spice-client-0.7.2-1.el6 fixing this has been build, moving to modified.

Comment 4 Michal Haško 2011-04-08 13:46:17 UTC

VERIFIED on spice-client-0.8.0-2.el6

excerpt from ~/.spicec/spicec.log:
1302269813 ERROR [3716:3717] RedPeer::verify_subject: host-subject mismatch
1302269813 ERROR [3716:3717] RedPeer::connect_secure: failed to connect w/SSL, ssl_error error:00000001:lib(0):func(0):reason(1)
1302269813 WARN [3716:3717] RedChannel::run: SSL Error:
1302269813 INFO [3716:3716] main: Spice client terminated (exitcode = 7)

Comment 5 Tomas Capek 2011-05-17 11:35:19 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
If the client failed verification because of a subject mismatch between the supplied host and the actual host, the error message given was too short to be useful. With this     update, the error message is now sufficiently informative.

Comment 6 errata-xmlrpc 2011-05-19 13:15:24 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0583.html