Missing log warning when using old werkzeug<0.10
- Dominant language
- Python
- Stars
- 68
- Forks
- 58
- PR merge metrics
- No merged PRs in 30d
Description
When using `rbd-iscsi-api` on Centos 7 SSL verification fails on the `rbd-iscsi-api` because the api server doesn't send a cert chain despite it being provided in `/etc/ceph/iscsi-gateway.crt`. We traced it to:
https://github.com/ceph/ceph-iscsi/blob/3a7dcf4e3fb54eaf16167a4c393d9ee56a83667d/rbd-target-api.py#L2822-L2830
When using `werkzeug==0.9.1`, `context.use_privatekey_file` does not send the full certificate chain. Ideally, this should at least result in a warning in the logs that this may cause verification problems. The verification issue isn't present when using an upgraded `werkzeug>10.0`.
Using curl to get the error:
```
# curl -I https://ceph-gw.example.com:5000
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
```
Using openssl to show what the server is actually sending:
`openssl s_client -showcerts -connect ceph-gw.example.com:5000`
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at rbd-target-api.py lines 2822-2830, then compare the certificate-chain behavior of werkzeug 0.9.1 with versions above 10.0. Use the provided curl and openssl s_client commands to reproduce and inspect the server response. Done means the old-version condition produces a clear log warning about possible certificate verification problems.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 30/100