ceph / ceph/ceph-iscsi

Missing log warning when using old werkzeug<0.10

Open
#159 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
68
Forks
58
PR merge metrics
No merged PRs in 30d

Description

When using `rbd-iscsi-api` on Centos 7 SSL verification fails on the `rbd-iscsi-api` because the api server doesn't send a cert chain despite it being provided in `/etc/ceph/iscsi-gateway.crt`. We traced it to:

https://github.com/ceph/ceph-iscsi/blob/3a7dcf4e3fb54eaf16167a4c393d9ee56a83667d/rbd-target-api.py#L2822-L2830

When using `werkzeug==0.9.1`, `context.use_privatekey_file` does not send the full certificate chain. Ideally, this should at least result in a warning in the logs that this may cause verification problems. The verification issue isn't present when using an upgraded `werkzeug>10.0`.

Using curl to get the error:
```
# curl -I https://ceph-gw.example.com:5000
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
```

Using openssl to show what the server is actually sending:
`openssl s_client -showcerts -connect ceph-gw.example.com:5000`

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at rbd-target-api.py lines 2822-2830, then compare the certificate-chain behavior of werkzeug 0.9.1 with versions above 10.0. Use the provided curl and openssl s_client commands to reproduce and inspect the server response. Done means the old-version condition produces a clear log warning about possible certificate verification problems.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.