Generating SSL certs fails with IPv6 addresses in undercloud.conf

Open
#394 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
45/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
ansible
Domain
devops, networking

Research direction

Start with plugins/tripleo-undercloud/tasks/ssl.yml at line 38 and inspect how undercloud_admin_host is used to build the openssl subject. Reproduce with an IPv6 address containing a CIDR suffix, then verify the generated certificate request succeeds without the suffix being passed to openssl.

Written by the indexing model from the issue text.

Description

when undercloud.conf is populated with an IPv6 address for undercloud_admin_host the notation includes the cidr for the address.

and related stanza do not trim off the cidr, and the cird then causes the openssl call to fail with "Hit end of string before finding the equals". The task needs to validate that there is no /### at the end of the string before passing it to the openssl command.

TASK [create the self signed CA certificate] ***********************************
task path: /home/rhos-ci/jenkins/workspace/OSPD-Customized-Deployment-virt/infrared/plugins/tripleo-undercloud/tasks/ssl.yml:38
Thursday 30 July 2020 17:50:23 +0000 (0:00:00.834) 0:12:27.690 *********
fatal: [undercloud-0]: FAILED! => {
"changed": true,
"cmd": [
"openssl",
"req",
"-new",
"-x509",
"-days",
"365",
"-key",
"undercloud-privkey.pem",
"-subj",
"/C=US/ST=NC/L=Raleigh/O=Red HAt/OU=QE/CN=fe32:dead:beef::2/64",
"-out",
"/etc/pki/ca-trust/source/anchors/undercloud-cacert.pem"
],
"delta": "0:00:00.004445",
"end": "2020-07-30 13:50:24.440774",
"rc": 1,
"start": "2020-07-30 13:50:24.436329"
}

STDERR:

req: Hit end of string before finding the equals.
problems making Certificate Request

Dominant language
Jinja
Stars
105
Forks
100
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from redhat-openstack/infrared

All issues in redhat-openstack/infrared

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.