Bug 1703951 - foreman_scap_client command fails with execution expired (Timeout::Error)
Summary: foreman_scap_client command fails with execution expired (Timeout::Error)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: SCAP Plugin
Version: 6.4.2
Hardware: All
OS: All
unspecified
medium
Target Milestone: 6.10.0
Assignee: Ondřej Pražák
QA Contact: Jameer Pathan
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-04-29 08:04 UTC by Nagoor Shaik
Modified: 2023-10-06 18:16 UTC (History)
10 users (show)

Fixed In Version: ansiblerole-foreman_scap_client-0.0.4, puppet-foreman_scap_client-0.3.22, rubygem-foreman_scap_client-0.4.6
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-16 14:08:28 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 26699 0 Normal Closed Add configurable timout for foreman_scap_client 2021-02-01 20:22:27 UTC
Foreman Issue Tracker 26700 0 Normal Closed Add configurable timout for foreman_scap_client - puppet-foreman_scap_client 2021-02-01 20:22:26 UTC
Foreman Issue Tracker 26701 0 Normal New Add configurable timeout for foreman_scap_client - ansible-foreman_scap_client 2021-02-01 20:22:27 UTC
Red Hat Knowledge Base (Solution) 4148331 0 Performance tune None Configure a read_timeout value for OpenSCAP clients. 2019-05-15 16:00:07 UTC
Red Hat Product Errata RHSA-2021:4702 0 None None None 2021-11-16 14:08:40 UTC

Description Nagoor Shaik 2019-04-29 08:04:13 UTC
Description of problem:
foreman_scap_client command fails with execution expired (Timeout::Error)

Version-Release number of selected component (if applicable):
Satellite 6.4.2

How reproducible:
N/A

Steps to Reproduce:
Not able to reproduce. However, configuring a read_timeout in the scap client get rid of the timeout errors.

NOTE: Even though the client errors out, OpenSCAP reports are uploading just fine.

Actual results:
Running a foreman_scap_client fails with the following error

# time foreman_scap_client 20
DEBUG: running: oscap xccdf eval --profile xccdf_com.example_profile_usgcb-rhel6-server --tailoring-file /var/lib/openscap/tailoring/ssg-rhel6-ds-tailoring_04_2019.xml --results-arf /tmp/d20190424-84862-18wfsku/results.xml /var/lib/openscap/content/ssg-rhel6-ds_04_2019.xml
WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
WARNING: Skipping https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL6.xml.bz2 file which is referenced from XCCDF content
DEBUG: running: /usr/bin/bzip2 /tmp/d20190424-84862-18wfsku/results.xml
Uploading results to https://satellite.example.com:9090/compliance/arf/20
/usr/lib/ruby/1.8/timeout.rb:64:in `rbuf_fill': execution expired (Timeout::Error)
        from /usr/lib/ruby/1.8/net/protocol.rb:134:in `rbuf_fill'
        from /usr/lib/ruby/1.8/net/protocol.rb:116:in `readuntil'
        from /usr/lib/ruby/1.8/net/protocol.rb:126:in `readline'
        from /usr/lib/ruby/1.8/net/http.rb:2028:in `read_status_line'
        from /usr/lib/ruby/1.8/net/http.rb:2017:in `read_new'
        from /usr/lib/ruby/1.8/net/http.rb:1051:in `request'
        from /usr/lib/ruby/1.8/net/http.rb:1037:in `request'
        from /usr/lib/ruby/1.8/net/http.rb:543:in `start'
        from /usr/lib/ruby/1.8/net/http.rb:1035:in `request'
        from /usr/lib/ruby/gems/1.8/gems/foreman_scap_client-0.3.0/lib/foreman_scap_client/client.rb:95:in `upload'
        from /usr/lib/ruby/gems/1.8/gems/foreman_scap_client-0.3.0/lib/foreman_scap_client/client.rb:23:in `run'
        from /usr/lib/ruby/1.8/tmpdir.rb:129:in `mktmpdir'
        from /usr/lib/ruby/gems/1.8/gems/foreman_scap_client-0.3.0/lib/foreman_scap_client/client.rb:19:in `run'
        from /usr/lib/ruby/gems/1.8/gems/foreman_scap_client-0.3.0/bin/foreman_scap_client:10
        from /usr/bin/foreman_scap_client:19:in `load'
        from /usr/bin/foreman_scap_client:19

real    1m30.424s
user    0m26.026s
sys     0m4.483s

Expected results:
Make read_timeout configurable under /etc/foreman_scap_client/config.yaml file

Additional info:

NOTE: Even though foreman_scap_client command errors out, client openscap reports uploads without any issues. 

Increasing proxy_request_timeout and applying a patch from https://projects.theforeman.org/issues/25501 didn't help. 

Issue was fixed by adding a read_timeout in client configuration as below

 On RHEL 6 : /usr/lib/ruby/gems/1.8/gems/foreman_scap_client-0.3.0/lib/foreman_scap_client/client.rb
 On RHEL 7 :  /usr/share/gems/gems/foreman_scap_client-0.3.0/lib/foreman_scap_client/client.rb

def generate_https_object(uri)
      https = Net::HTTP.new(uri.host, uri.port)
      https.use_ssl = true
      https.read_timeout = 240               ------> read_timeout parameter added 
      https.verify_mode = OpenSSL::SSL::VERIFY_PEER
      https.ca_file = config[:ca_file]
      begin
        https.cert = OpenSSL::X509::Certificate.new File.read(config[:host_certificate])
        https.key = OpenSSL::PKey::RSA.new File.read(config[:host_private_key])
      rescue StandardError => e
        puts 'Unable to load certs'
        puts e.message
        exit(3)
      end
      https
    end

Comment 3 Ondřej Pražák 2019-04-29 08:07:48 UTC
Connecting redmine issue http://projects.theforeman.org/issues/26699 from this bug

Comment 7 Jameer Pathan 2021-08-12 13:57:46 UTC
Verified

Verified with:
- Satellite 6.10.0 snap 12
- tfm-rubygem-openscap-0.4.9-5.el7sat.noarch
- puppet-foreman_scap_client-0.4.0-1.el7sat.noarch
- ansiblerole-foreman_scap_client-0.2.0-1.el7sat.noarch
- rubygem-foreman_scap_client-0.5.0-1.el7sat.noarch


Test steps:
- Import theforeman.foreman_scap_client ansible role.
- Import foreman_scap_client puppet class.
- Configure a host for openscap using ansible/puppet.
- Update timeout parameter's value and run ansible role/puppet to update openscap configuration on host.

Observation:
- foreman_scap_client_timeout ansible variable is present.
- timeout smartclass parameter in foreman_scap_client puppet class.
- timeout value in /etc/foreman_scap_client/config.yaml updated successfully.

Comment 11 errata-xmlrpc 2021-11-16 14:08:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4702


Note You need to log in before you can comment on or make changes to this bug.