Bug 2130695 - crypto-policy : Logging Improvement and publish the source of ciphers
Summary: crypto-policy : Logging Improvement and publish the source of ciphers
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Container Native Virtualization (CNV)
Classification: Red Hat
Component: Infrastructure
Version: 4.12.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.12.0
Assignee: Dominik Holler
QA Contact: Geetika Kapoor
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-09-28 21:36 UTC by Geetika Kapoor
Modified: 2023-02-01 12:56 UTC (History)
2 users (show)

Fixed In Version: v4.12.0-714
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-01-24 13:41:07 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github kubevirt ssp-operator pull 416 0 None open Deploying state and tests for TLSSecurityProfile 2022-11-03 13:45:44 UTC
Github kubevirt ssp-operator pull 447 0 None Merged [release-v0.16] Manual backport of deploying state and tests for TLSSecurityProfile 2022-11-18 14:58:07 UTC
Red Hat Issue Tracker CNV-21554 0 None None None 2022-10-10 09:23:34 UTC
Red Hat Product Errata RHSA-2023:0408 0 None None None 2023-01-24 13:41:16 UTC

Description Geetika Kapoor 2022-09-28 21:36:18 UTC
Description of problem:

SSP logging at the moment show

{"level":"info","ts":1664398497.9982593,"logger":"setup","msg":"Got Ciphers and tlsProfile:","ciphers: ":["DHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-AES128-GCM-SHA256"],"tlsProfile: ":"VersionTLS12"}

It doesn't show from which source the ciphers are being enforced. In this case, i got the ciphers from APIServer and not from HCO as HCO doesn't have tlsSecurityProfile set. It will be good to know the source of getting ciphers and other details like TLS session based information.

Example : 
[cnv-qe-jenkins@c01-gkcrypt26-xr7zz-executor ~]$ oc get apiserver cluster -ojsonpath={.spec.tlsSecurityProfile}
{"custom":{"ciphers":["DHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-AES128-GCM-SHA256"],"minTLSVersion":"VersionTLS12


[cnv-qe-jenkins@c01-gkcrypt26-xr7zz-executor ~]$ oc get hco kubevirt-hyperconverged -ojsonpath={.spec.tlsSecurityProfile}  

[cnv-qe-jenkins@c01-gkcrypt26-xr7zz-executor ~]$ oc get ssp ssp-kubevirt-hyperconverged -ojsonpath={.spec.tlsSecurityProfile}
{"custom":{"ciphers":["DHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-AES128-GCM-SHA256"],"minTLSVersion":"VersionTLS12"},"type":"Custom"}
 

Version-Release number of selected component (if applicable):

4.12
How reproducible:
always

Steps to Reproduce:
1.
2.
3.

Actual results:
Logging Improvement needed   

Expected results:

Logging Improvement to help users to get useful information at one place and easily accessible using must-gather

Additional info:

Comment 4 Geetika Kapoor 2022-12-15 12:10:24 UTC
Test Env:

Deployed: OCP-4.12.0-rc.4
Deployed: CNV-v4.12.0-758

Test Cases:

What works

Test Case 1: ON SSP, set Modern

  tlsSecurityProfile:
    modern: {}
    type: Modern

 oc logs ssp-operator-56569f8cbd-nvj26  -n openshift-cnv| grep cipher
{"level":"info","ts":1670788666.9830906,"logger":"setup tls options","msg":"Got Ciphers and tlsProfile:","ciphers: ":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","TLS_CHACHA20_POLY1305_SHA256"],"tlsProfile: ":"VersionTLS13"}


Test Case 2: On SSP, set Old But HCO points to modern

$ oc logs ssp-operator-56569f8cbd-nvj26  -n openshift-cnv --follow=true| grep cipher
{"level":"info","ts":1671105027.098432,"logger":"setup tls options","msg":"Got Ciphers and tlsProfile:","ciphers: ":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","TLS_CHACHA20_POLY1305_SHA256","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-CHACHA20-POLY1305","ECDHE-RSA-CHACHA20-POLY1305","DHE-RSA-AES128-GCM-SHA256","DHE-RSA-AES256-GCM-SHA384","DHE-RSA-CHACHA20-POLY1305","ECDHE-ECDSA-AES128-SHA256","ECDHE-RSA-AES128-SHA256","ECDHE-ECDSA-AES128-SHA","ECDHE-RSA-AES128-SHA","ECDHE-ECDSA-AES256-SHA384","ECDHE-RSA-AES256-SHA384","ECDHE-ECDSA-AES256-SHA","ECDHE-RSA-AES256-SHA","DHE-RSA-AES128-SHA256","DHE-RSA-AES256-SHA256","AES128-GCM-SHA256","AES256-GCM-SHA384","AES128-SHA256","AES256-SHA256","AES128-SHA","AES256-SHA","DES-CBC3-SHA"],"tlsProfile: ":"VersionTLS10"} ======> THis should be minTLSVersion 
{"level":"info","ts":1671105027.0985553,"logger":"setup.TLSSecurityProfile","msg":"Unsupported cipher name: ","Cipher Name":"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"}
{"level":"info","ts":1671105027.0985746,"logger":"setup.TLSSecurityProfile","msg":"Unsupported cipher name: ","Cipher Name":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}
{"level":"info","ts":1671105027.098589,"logger":"setup.TLSSecurityProfile","msg":"Unsupported cipher name: ","Cipher Name":"TLS_RSA_WITH_AES_128_CBC_SHA256"}
{"level":"info","ts":1671105027.0986006,"logger":"setup.TLSSecurityProfile","msg":"Unsupported cipher name: ","Cipher Name":"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}
{"level":"info","ts":1671105032.0398319,"logger":"setup.TLSSecurityProfile","msg":"Unsupported cipher name: ","Cipher Name":"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"}
{"level":"info","ts":1671105032.0398426,"logger":"setup.TLSSecurityProfile","msg":"Unsupported cipher name: ","Cipher Name":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}
{"level":"info","ts":1671105032.039861,"logger":"setup.TLSSecurityProfile","msg":"Unsupported cipher name: ","Cipher Name":"TLS_RSA_WITH_AES_128_CBC_SHA256"}
{"level":"info","ts":1671105032.0398755,"logger":"setup.TLSSecurityProfile","msg":"Unsupported cipher name: ","Cipher Name":"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}
{"level":"info","ts":1671105032.0398805,"logger":"setup","msg":"Configured ciphers","ciphers":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,156,157,47,53]} =====> CAN BE MORE USER FRIENDLY


Reverts back to modern.
$ oc logs ssp-operator-56569f8cbd-nvj26  -n openshift-cnv| grep cipher
{"level":"info","ts":1671104814.0942738,"logger":"setup tls options","msg":"Got Ciphers and tlsProfile:","ciphers: ":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","TLS_CHACHA20_POLY1305_SHA256"],"tlsProfile: ":"VersionTLS13"}
{"level":"info","ts":1671104819.0134308,"logger":"setup","msg":"Configured ciphers","ciphers":[]}


What doesn't work

1. Cipher switch that happens and when ciphers are overwritten by apiserver or hco and reason for switch
2. Doesn't show handshake process logs for good/bad sessions

Comment 7 errata-xmlrpc 2023-01-24 13:41:07 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Virtualization 4.12.0 Images security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:0408


Note You need to log in before you can comment on or make changes to this bug.