Bug 1977699 - [pulp3] rhsm certguard failure messages are lost in log-level debug
Summary: [pulp3] rhsm certguard failure messages are lost in log-level debug
Keywords:
Status: POST
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Pulp
Version: 6.10.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: Unspecified
Assignee: satellite6-bugs
QA Contact: Satellite QE Team
URL:
Whiteboard:
Depends On:
Blocks: 1957813
TreeView+ depends on / blocked
 
Reported: 2021-06-30 10:02 UTC by Matthias Dellweg
Modified: 2023-07-25 19:21 UTC (History)
7 users (show)

Fixed In Version: pulp-certguard-1.5.8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github pulp pulp-certguard issues 145 0 None closed RHSM certguard failure messages are lost in log-level debug 2023-01-18 18:49:45 UTC
Red Hat Issue Tracker SAT-18410 0 None None None 2023-06-14 14:43:36 UTC

Description Matthias Dellweg 2021-06-30 10:02:09 UTC
Description of problem:
When a client is denied access by the rhsm-certguard, the log messages describing the reason are lost with log level debug. They should be raised to at least warning, because they tell an administrator, why a client is unable to consume their subscriptions.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Subscribe a host to RH subscription content
2. Find a reason for the rhsm content guard to reject the client certificate
   Either https://bugzilla.redhat.com/show_bug.cgi?id=1977893,
   or misconfigure it, see below
3. On the host run `yum update` and observe that repodata.xml returns 403
4. In forman-tail observe that all reasons for ^ are in log level DEBUG

Actual results:


Expected results:
Failed authentication to subscription content should be logged at a higher level, maybe WARNING.


Additional info:

  Misconfiguring may be:
  `curl -vv -k -X PATCH  --data-urlencode 'ca_certificate' --cert /etc/pki/katello/certs/pulp-client.crt --key /etc/pki/katello/private/pulp-client.key "https://localhost/pulp/api/v3/contentguards/certguard/rhsm/<UUID>/"`

Comment 1 Brad Buckingham 2021-07-01 14:27:05 UTC
Hi Matthias, 

Can we provide a set of reproducer steps for QE to verify once a fix is available?  Thanks!

Comment 2 Grant Gainey 2021-07-02 12:28:17 UTC
I suspect this is a combination of https://github.com/pulp/pulp-certguard/blob/master/pulp_certguard/app/models.py#L42 and https://github.com/pulp/pulp-certguard/blob/master/pulp_certguard/app/models.py#L167-L169.

In the first, we only log "this doesn't even look like a cert" at debug-level.

In the second, we lose information on the specific error encountered and log "something went wrong".

Comment 3 Grant Gainey 2021-07-02 13:09:26 UTC
From discussion w/ Matthias:

certguard raises PermissionError, which is a base python error-class.  These error-messages appear to not show up in logging. Investigation needed on whether PermissionError is "special" in some way when it comes to being logged by the content-app.

NOTE: we really should not be overloadiung python's file-level PermissionError this way, and instead should have our own cecrtguard-perm-error. May want its own RFE.

See https://github.com/pulp/pulpcore/blob/master/pulpcore/content/handler.py#L296-L303 for where we might want to increase log-level.

Comment 4 Matthias Dellweg 2021-07-13 12:49:36 UTC
Provided the steps as part of the original comment.

Comment 5 pulp-infra@redhat.com 2021-07-26 08:09:10 UTC
The Pulp upstream bug status is at NEW. Updating the external tracker on this bug.

Comment 6 pulp-infra@redhat.com 2021-07-26 08:09:11 UTC
The Pulp upstream bug priority is at Normal. Updating the external tracker on this bug.

Comment 10 Robin Chan 2023-03-02 15:05:54 UTC
All upstream Pulp bugs are at MODIFIED+. Moving this bug to POST.


Note You need to log in before you can comment on or make changes to this bug.