Bug 1665837
| Summary: | crash when attempting to connect using encrypted client TLS certificate | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Ján Tomko <jtomko> | ||||
| Component: | gtk-vnc | Assignee: | Daniel Berrangé <berrange> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Desktop QE <desktop-qa-list> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 8.0 | CC: | mkrajnak, tpelka | ||||
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
||||
| Target Release: | 8.0 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | gtk-vnc-0.9.0-2.el8 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2020-04-28 15:59:10 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Ján Tomko
2019-01-14 08:49:27 UTC
Hi Jan, I was just trying to verify this, as i don't have that much experiences with this, I followed the guidelines https://wiki.libvirt.org/page/TLSSetup (hopefully without flaws) on top of that I applied instruction from your reproducer. I can get the working connection, my host machine is rhel 8.2 with 8.2 guest as well. However I am only getting the black screen when I am connecting to the vm which is runnig without problems, I can ssh to it and the most important thing there is no crash of remote viewer. Log: $remote-viewer -v vnc+tls://192.168.122.127:5900 Guest (null) has a vnc display Opening connection to display at vnc+tls://192.168.122.127:5900 I was wondering if you can think of a reason causing the black screen, I will try to poke around more to be sure I can't crash it. Did you supply the password option to certtool when generating the client key?
When getting info about the key file, certtool should ask for the password:
# certtool -k --infile /etc/pki/libvirt/private/clientkey.pem
Encrypted structure detected...
PKCS #8 information:
Cipher: AES-128-CBC
Schema: PBES2-AES128-CBC (2.16.840.1.101.3.4.1.2)
Salt: df883a227c0985ae137674ffe1799424749ad7e9c7
Salt size: 21
Iteration count: 5150
Enter password:
Note that remote-viewer should not be able to connect, since encrypted client keys
are AFAIK unsupported. This bug is about remote-viewer not crashing when encoutering
such files. With --gtk-vnc-debug, I'm getting the following message when attempting
to connect (RPM built from git master - commit 8de814d2c ):
src/vncconnection.c Cannot load certificate & key Decryption has failed.
With Fedora 30's gtk-vnc-0.9.0-5.fc30, remote-viewer crashes.
(In reply to Ján Tomko from comment #4) > Did you supply the password option to certtool when generating the client > key? > > When getting info about the key file, certtool should ask for the password: > > # certtool -k --infile /etc/pki/libvirt/private/clientkey.pem > Encrypted structure detected... > PKCS #8 information: > Cipher: AES-128-CBC > Schema: PBES2-AES128-CBC (2.16.840.1.101.3.4.1.2) > Salt: df883a227c0985ae137674ffe1799424749ad7e9c7 > Salt size: 21 > Iteration count: 5150 > > Enter password: > > > Note that remote-viewer should not be able to connect, since encrypted > client keys > are AFAIK unsupported. This bug is about remote-viewer not crashing when > encoutering > such files. With --gtk-vnc-debug, I'm getting the following message when > attempting > to connect (RPM built from git master - commit 8de814d2c ): > > src/vncconnection.c Cannot load certificate & key Decryption has failed. > > With Fedora 30's gtk-vnc-0.9.0-5.fc30, remote-viewer crashes. Hello Jan, yes, in my case: [root@localhost private]# certtool -k --infile /etc/pki/libvirt/private/clientkey.pem Encrypted structure detected... PKCS #8 information: Cipher: AES-128-CBC Schema: PBES2-AES128-CBC (2.16.840.1.101.3.4.1.2) Salt: a64e7f8b7865a20e5fec3f1cc648d0b4c00446 Salt size: 19 Iteration count: 5123 Enter password: So the results are following: 1. When I start vm with VirtViewer, change connection to VNC I am seeing a message in console: Viewer is disconnected (see screenshot) 2. When I use vnc-viewer: $ remote-viewer -v vnc+tls://192.168.122.127:5900 Guest (null) has a vnc display Opening connection to display at vnc+tls://192.168.122.127:5900 after a while I got this: Guest x11 display has disconnected, shutting down 3. I've also rebuilt the srpm and tried gvncviewer utility, but since it's meant to be simple I'ts not working with vnc+tls at all, otherwise it's the same, blank screen. So I have no crashes on my side, would you consider it fixed or is there anything more I can try ? Created attachment 1650622 [details]
VirtViewer Console,
(In reply to Martin Krajnak from comment #6) > So I have no crashes on my side, would you consider it fixed or is there > anything more I can try ? Looks good to me! (In reply to Ján Tomko from comment #8) > (In reply to Martin Krajnak from comment #6) > > So I have no crashes on my side, would you consider it fixed or is there > > anything more I can try ? > > Looks good to me! Thanks Jan, flipping to VERIFIED on behalf of Martin. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1690 |