Bug 2130588 - crypto-policy : Common Ciphers support by apiserver and hco
Summary: crypto-policy : Common Ciphers support by apiserver and hco
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Container Native Virtualization (CNV)
Classification: Red Hat
Component: Installation
Version: 4.12.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 4.12.0
Assignee: João Vilaça
QA Contact: Geetika Kapoor
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-09-28 14:20 UTC by Geetika Kapoor
Modified: 2023-01-24 13:41 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-01-24 13:41:07 UTC
Target Upstream Version:
Embargoed:
jvilaca: needinfo+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github kubevirt hyperconverged-cluster-operator pull 2108 0 None Merged Validate TLS Security Profiles have required HTTP/2 cipher 2022-10-18 12:57:11 UTC
Red Hat Issue Tracker CNV-21547 0 None None None 2022-11-02 16:50:44 UTC
Red Hat Product Errata RHSA-2023:0408 0 None None None 2023-01-24 13:41:16 UTC

Description Geetika Kapoor 2022-09-28 14:20:07 UTC
Description of problem:

-- patch apiserver with ciphers ["DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"]

$ oc patch apiserver  --type=json cluster -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS12", ciphers: ["DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"]}, type: "Custom"} }]'
The APIServer "cluster" is invalid:
* spec.tlsSecurityProfile.custom.ciphers: Invalid value: []string{"DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"}: no supported cipher suite found
* spec.tlsSecurityProfile.custom.ciphers: Invalid value: []string{"DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"}: http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of ECDHE-RSA-AES128-GCM-SHA256 or ECDHE-ECDSA-AES128-GCM-SHA256)

-- patch hco with ciphers ["DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"]


$ oc patch hco -n openshift-cnv --type=json kubevirt-hyperconverged -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS12", ciphers: ["DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"]}, type: "Custom"} }]'
hyperconverged.hco.kubevirt.io/kubevirt-hyperconverged patched

cipher ECDHE-RSA-AES128-GCM-SHA256 or ECDHE-ECDSA-AES128-GCM-SHA256 is mandatory for now for apiserver.

Version-Release number of selected component (if applicable):
4.12 with FIPS

How reproducible:
always

Steps to Reproduce:
1.try to patch apiserver and hco
2.
3.

Actual results:

supported ciphers should be in sync. Here we see some of the ciphers which are not accepted by apiserver while they are accepted by hco

Expected results:
common ciphers should be supported by all 

Additional info:

$  oc patch apiserver  --type=json cluster -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS13", ciphers: ["TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"]}, type: "Custom"} }]'
The APIServer "cluster" is invalid: 
* spec.tlsSecurityProfile.custom.ciphers: Invalid value: []string{"TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"}: no supported cipher suite found
* spec.tlsSecurityProfile.custom.minTLSVersion: Unsupported value: "VersionTLS13": supported values: "VersionTLS10", "VersionTLS11", "VersionTLS12"

--> No support for TLS 1.3 at the moment

Comment 3 Geetika Kapoor 2022-11-18 00:26:00 UTC
Test Environment :

$ oc get csv -n openshift-cnv
NAME                                       DISPLAY                       VERSION   REPLACES                                   PHASE
kubevirt-hyperconverged-operator.v4.12.0   OpenShift Virtualization      4.12.0    kubevirt-hyperconverged-operator.v4.11.0   Succeeded


Test Case 1: Patch when custom and minTLSVersion: "VersionTLS12"

1. Patch apiserver with custom ciphers

$ oc patch apiserver  --type=json cluster -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS12", ciphers: ["DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"]}, type: "Custom"} }]'
The APIServer "cluster" is invalid: 
* spec.tlsSecurityProfile.custom.ciphers: Invalid value: []string{"DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"}: no supported cipher suite found
* spec.tlsSecurityProfile.custom.ciphers: Invalid value: []string{"DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"}: http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of ECDHE-RSA-AES128-GCM-SHA256 or ECDHE-ECDSA-AES128-GCM-SHA256)

2. Patch hco with custom ciphers

$ oc patch hco -n openshift-cnv --type=json kubevirt-hyperconverged -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS11", ciphers: ["DHE-RSA-AES256-GCM-SHA384", "DHE-RSA-CHACHA20-POLY1305"]}, type: "Custom"} }]'
Error from server (http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of ECDHE-RSA-AES128-GCM-SHA256 or ECDHE-ECDSA-AES128-GCM-SHA256)): admission webhook "validate-hco.kubevirt.io" denied the request: http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of ECDHE-RSA-AES128-GCM-SHA256 or ECDHE-ECDSA-AES128-GCM-SHA256)

Test Case 2: Patch when custom and minTLSVersion: "VersionTLS13"

1. Patch apiserver with custom ciphers

$ oc patch apiserver  --type=json cluster -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS13", ciphers: ["TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"]}, type: "Custom"} }]'
The APIServer "cluster" is invalid: 
* spec.tlsSecurityProfile.custom.ciphers: Invalid value: []string{"TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"}: no supported cipher suite found
* spec.tlsSecurityProfile.custom.minTLSVersion: Unsupported value: "VersionTLS13": supported values: "VersionTLS10", "VersionTLS11", "VersionTLS12"

2. Patch hco with custom ciphers

$ oc patch hco -n openshift-cnv --type=json kubevirt-hyperconverged -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS13", ciphers: ["TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"]}, type: "Custom"} }]'
hyperconverged.hco.kubevirt.io/kubevirt-hyperconverged patched

$ oc get hco kubevirt-hyperconverged -n openshift-cnv -ojsonpath={.spec.tlsSecurityProfile} 
{"custom":{"ciphers":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384"],"minTLSVersion":"VersionTLS13"},"type":"Custom"}

Test Result: 
===========

Test Case 1 works as expected but with test case 2 i see a behavior differences between  apiserver and hco. 

Additional info :
================

If i specify below ciphers :

$ oc patch hco -n openshift-cnv --type=json kubevirt-hyperconverged -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS13", ciphers: ["DHE-RSA-AES256-GCM-SHA384", "ECDHE-RSA-AES256-GCM-SHA384"]}, type: "Custom"} }]'
The request is invalid: spec.configuration.tlsConfiguration.ciphers: You cannot specify ciphers when spec.configuration.tlsConfiguration.minTLSVersion is empty or VersionTLS13


-- HCO failed to patch as TLS version is 1.3 but in test case 2 , we were able to patch with some set of ciphers.

Comment 4 Geetika Kapoor 2022-11-18 00:27:09 UTC
I see a behavior issue when it comes to custom TLS 1.3 between apiserver and hco.

Comment 5 Simone Tiraboschi 2022-11-21 11:11:31 UTC
This is expected, see https://wiki.openssl.org/index.php/TLS1.3#Ciphersuites

OpenSSL has implemented support for five TLSv1.3 ciphersuites as follows:
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256
TLS_AES_128_CCM_8_SHA256
TLS_AES_128_CCM_SHA256

so
$ oc patch hco -n openshift-cnv --type=json kubevirt-hyperconverged -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS13", ciphers: ["TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"]}, type: "Custom"} }]'
hyperconverged.hco.kubevirt.io/kubevirt-hyperconverged patched

is indeed valid

while
$ oc patch hco -n openshift-cnv --type=json kubevirt-hyperconverged -p '[{"op": "replace", "path": /spec/tlsSecurityProfile, "value": {custom: {minTLSVersion: "VersionTLS13", ciphers: ["DHE-RSA-AES256-GCM-SHA384", "ECDHE-RSA-AES256-GCM-SHA384"]}, type: "Custom"} }]'
The request is invalid: spec.configuration.tlsConfiguration.ciphers: You cannot specify ciphers when spec.configuration.tlsConfiguration.minTLSVersion is empty or VersionTLS13

is not.

Maybe the text of the error message is misleading or at least confusing.

Comment 9 errata-xmlrpc 2023-01-24 13:41:07 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Virtualization 4.12.0 Images security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:0408


Note You need to log in before you can comment on or make changes to this bug.