Bug 670274 - not verbose enough error message when subject-host differs from server
not verbose enough error message when subject-host differs from server
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: spice-client (Show other bugs)
6.1
Unspecified Unspecified
low Severity medium
: rc
: ---
Assigned To: Hans de Goede
Desktop QE
:
Depends On:
Blocks: 671383
  Show dependency treegraph
 
Reported: 2011-01-17 13:33 EST by Alon Levy
Modified: 2014-08-04 18:08 EDT (History)
5 users (show)

See Also:
Fixed In Version: spice-client-0.7.2-1.el6
Doc Type: Bug Fix
Doc Text:
If the client failed verification because of a subject mismatch between the supplied host and the actual host, the error message given was too short to be useful. With this update, the error message is now sufficiently informative.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-05-19 09:15:24 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Alon Levy 2011-01-17 13:33:13 EST
Description of problem:
If the client fails verification because of a subject mismatch between
supplied host and actual host, it laconicly says "SSL error 1" instead
of giving a better error message. Fix is ACKED upstream:

 http://lists.freedesktop.org/archives/spice-devel/2011-January/002205.html

 client: log subject-host mismatch, and raise ssl warnings to errors


Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. start qemu with secure channels, with subject $A != $B, some random string.
2. connect using --host-subject $B
  
Actual results:
look at $HOME/.spicec/spicec.log, it won't say "subject host differs", but just "SSL failed"


Expected results:
Should say subject host verification failed.

Additional info:
Comment 2 Hans de Goede 2011-01-25 08:52:01 EST
A new spice-client-0.7.2-1.el6 fixing this has been build, moving to modified.
Comment 4 Michal Haško 2011-04-08 09:46:17 EDT
VERIFIED on spice-client-0.8.0-2.el6

excerpt from ~/.spicec/spicec.log:
1302269813 ERROR [3716:3717] RedPeer::verify_subject: host-subject mismatch
1302269813 ERROR [3716:3717] RedPeer::connect_secure: failed to connect w/SSL, ssl_error error:00000001:lib(0):func(0):reason(1)
1302269813 WARN [3716:3717] RedChannel::run: SSL Error:
1302269813 INFO [3716:3716] main: Spice client terminated (exitcode = 7)
Comment 5 Tomas Capek 2011-05-17 07:35:19 EDT
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
If the client failed verification because of a subject mismatch between the supplied host and the actual host, the error message given was too short to be useful. With this     update, the error message is now sufficiently informative.
Comment 6 errata-xmlrpc 2011-05-19 09:15:24 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0583.html

Note You need to log in before you can comment on or make changes to this bug.