Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 830679

Summary: [Patch] Make rhui-manager allows valid RHUI entitlement certificates w/ extension other than ".pem"
Product: Red Hat Update Infrastructure for Cloud Providers Reporter: Satoru SATOH <ssato>
Component: RHUAAssignee: John Matthews <jmatthew>
Status: CLOSED ERRATA QA Contact: mkovacik
Severity: medium Docs Contact:
Priority: high    
Version: 2.1CC: cbillett, jmatthew, kbidarka, melewis, mfuruta, sclewis, sghai, tsanders, vkuznets
Target Milestone: ---Keywords: Triaged
Target Release: 2.1.3   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
This update fixes the assumption that a certificate was invalid if the file name did not use the extension .pem. This resulted in valid certificates being marked as invalid. This has been changed so that an attempt is made with the certificate and it is only marked as invalid after it has failed. This means that a certificate with any extension can be used and the file name no longer needs to end in .pem.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2013-12-17 20:08:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Make rhui.common.cert_utils.entitlements_in_cert catching X509.X509Error, etc.
none
Surround X509.load_cert_string() w/ try ... except and replace try ... finally w/ with statement
none
Surround X509.load_cert_string() w/ try ... except and replace try ... finally w/ with statement
none
Ensure valid certificates contain entitlements copied w/ '.pem' extension is added and not skipped during certs reload none

Description Satoru SATOH 2012-06-11 08:17:26 UTC 
Created attachment 590843 [details]
Make rhui.common.cert_utils.entitlements_in_cert catching X509.X509Error, etc.

Description of problem:

Current implementation of rhui-manager does not look allowing RHUI
entitlement certificates w/ extensions other than ".pem" and such
certificates are silently ignored and skipped.

That is, the following will be an error even if given file is correct
RHUI entitlement certificate:

# rhui-manager cert upload --cert rhua-entitlement-cert.txt
                                                        ^^^


IMHO, rhui-manager should allow files w/ any extensions and 
I made a series of patches implement this (not tested).


Version-Release number of selected component (if applicable):
rh-rhui-tools-2.0.64-1.el6_2
Comment 1 Satoru SATOH 2012-06-11 08:20:09 UTC 
Created attachment 590844 [details]
Surround X509.load_cert_string() w/ try ... except and replace try ... finally w/ with statement
Comment 2 Satoru SATOH 2012-06-11 08:23:14 UTC 
Created attachment 590845 [details]
Surround X509.load_cert_string() w/ try ... except and replace try ... finally w/ with statement
Comment 3 Satoru SATOH 2012-06-11 08:25:43 UTC 
Created attachment 590852 [details]
Ensure valid certificates contain entitlements copied w/ '.pem' extension is added and not skipped during certs reload

I tested _normalize_ext() as follows:

$ nosetests --verbose --with-doctest src/rhui/tools/cert_manager.py
Comment 4 wes hayutin 2012-07-30 20:11:22 UTC 
moving to version 2.1.1
Comment 5 mkovacik 2013-07-29 15:28:47 UTC 
Supposed fix will just prevent silent dropping of the cert file --- the only files accepted will remain those *.pem
Comment 6 John Matthews 2013-09-12 18:52:10 UTC 
Please hold off on committing this patch into RHUI.

We are considering moving to the RHSM certificate.py implementation in RHUI 2.1.3.  If we do move to that certificate implementation we can re-evaluate this BZ afterwards and see if work is needed to no longer require a .pem extension.
Comment 8 John Matthews 2013-11-18 15:35:10 UTC 
RHEL-6.4-RHUI-2.1.3-20131118.1-Server-x86_64-DVD1.iso
Comment 9 Vitaly Kuznetsov 2013-11-19 12:57:40 UTC 
Verified with rh-rhui-tools-2.1.36-1.el6_5:

1) Valid cert with '.txt' extension upload succeeded
2) Invalid cert with '.pem' extension upload failed
Comment 11 errata-xmlrpc 2013-12-17 20:08:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1854.html