Bug 2047913: Fix HAProxy tests on FIPS properly#26803
Conversation
This reverts commit 786a8ca.
openshift-ci
bot
added
bugzilla/severity-high
|
@Miciah: This pull request references Bugzilla bug 2047913, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/bugzilla refresh |
openshift-ci
bot
added
bugzilla/valid-bug
|
@Miciah: This pull request references Bugzilla bug 2047913, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
test/extended/util/url/url.go
Outdated
| port = "443" | ||
| } | ||
| } | ||
| resolve = fmt.Sprintf("--resolve %s:%s:%s", host, port, ut.ProxyHost) |
There was a problem hiding this comment.
will this function on ipv6?
There was a problem hiding this comment.
It should, if the address is bracketed. I've added a comment to Through to mention that IPv6 addresses should be bracketed. I've also replaced --resolve with --connect-to, which handles IPv4 addresses, bracketed IPv6 addresses, and host names (the last would have failed with --resolve, which would cause problems on platforms such as AWS where the LB status has a host name rather than an IP address).
|
/approve The overall approach looks reasonable. I'll leave lgtm with someone on network-edge. @frobware perhaps? |
openshift-ci
bot
added
the
approved
* test/extended/util/url/url.go (CURL): Add a new ProxyHost field. (Through): Assign the given address to ProxyHost instead of changing the request host or headers. (ToShell): Use Curl's --connect-to flag to specify the proxy host.
Change existing HAProxy tests to use a FIPS-compatible, 2048-bit RSA key.
Add a new test to verify that using a FIPS-incompatible, 1024-bit RSA key
for the router's default certificate fails on FIPS clusters and succeeds on
non-FIPS clusters.
The certificate used in this new test comes from the default certificate
that is currently built into the router image (which is why the tests were
failing on FIPS). The certificate used for the already existing tests was
generated using the following Shell commands on a RHEL 8.4 system with
OpenSSL 1.1.1g:
openssl req -x509 -newkey rsa:2048 -days 3650 -keyout ca.key -out ca.crt -nodes -subj '/C=US/ST=SC/L=Default City/O=Default Company Ltd/OU=Test CA/CN=www.exampleca.com/emailAddress=example@example.com'
openssl req -newkey rsa:2048 -nodes -keyout tls.key -out router.csr -subj '/CN=www.example.com/ST=SC/C=US/emailAddress=example@example.com/O=Example/OU=Example'
printf 'basicConstraints=CA:FALSE\n' > router.cnf
openssl x509 -req -days 3650 -in router.csr -signkey tls.key -CA ca.crt -CAcreateserial -CAkey ca.key -out tls.crt -clrext -extfile router.cnf
cat tls.{crt,key} > default_pub_keys.pem
These commands generate a certificate that has the same parameters as the
old one except for the serial number, signature algorithm, validity period,
and key size.
This commit fixes bug 2047913.
https://bugzilla.redhat.com/show_bug.cgi?id=2047913
* test/extended/router/certs.go: New file with the new tests.
* test/extended/testdata/router/router-common.yaml: Change route-1 and
route-2 from non-TLS routes to edge-terminated TLS routes with
insecureEdgeTerminationPolicy: Allow.
* test/extended/testdata/router/router-override-domains.yaml:
* test/extended/testdata/router/router-override.yaml:
* test/extended/testdata/router/router-scoped.yaml:
* test/extended/testdata/router/weighted-router.yaml: Add a parameter for
the default certificate with the default value being a certificate with a
FIPS-compatible, 2048-bit RSA key.
* test/extended/testdata/bindata.go:
* test/extended/util/annotate/generated/zz_generated.annotations.go:
Regenerate.
|
@Miciah: This pull request references Bugzilla bug 2047913, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Miciah
force-pushed
the
BZ2047913-fix-HAProxy-tests-on-FIPS-properly
branch
from
d0cab54 to
646a575
Compare
|
Latest push updates some additional manifests with the FIPS-compatible certificate and replaces |
|
The new test failed because the router started even with a FIPS-incompatible, 1024-bit key on a FIPS-enabled cluster. I'm not sure how that could happen. The test passed for me when I tested with cluster-bot; in manual testing, the router did not start with a FIPS-incompatible key on a FIPS-enabled GCP cluster. |
|
/test e2e-gcp-fips-serial |
|
Many failures. /retest |
|
The tests work on cluster-bot fips clusters. In addition to my earlier manual testing on a FIPS-enabled GCP cluster, I used I'm increasingly thinking that our e2e-aws-fips and e2e-gcp-fips-serial tests are broken. /test e2e-aws-fips |
Update the new tests that use a FIPS-incompatible key to gather and print out the content of /etc/crypto-policies/back-ends/opensslcnf.config so that the configured crypto-policy can be examined in case of test failures. * test/extended/router/certs.go: cat /etc/crypto-policies/back-ends/opensslcnf.config after each test.
|
@Miciah: An error was encountered querying GitHub for users with public email (hongli@redhat.com) for bug 2047913 on the Bugzilla server at https://bugzilla.redhat.com. No known errors were detected, please see the full error message for details. Full error message.
non-200 OK status code: 403 Forbidden body: "{\n \"documentation_url\": \"https://docs.github.com/en/free-pro-team@latest/rest/overview/resources-in-the-rest-api#secondary-rate-limits\",\n \"message\": \"You have exceeded a secondary rate limit. Please wait a few minutes before you try again.\"\n}\n"
Please contact an administrator to resolve this issue, then request a bug refresh with DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
The e2e-gcp-fips-serial job has gone missing... |
|
/test e2e-gcp-fips-serial |
|
/test images |
|
/test e2e-aws-fips |
|
/test e2e-aws-fips |
/test e2e-aws-fips |
|
/test e2e-aws-fips |
|
/retest |
1 similar comment
|
/retest |
|
/lgtm |
|
/skip |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: deads2k, frobware, Miciah The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@Miciah: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
@Miciah: All pull requests linked via external trackers have merged: Bugzilla bug 2047913 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
4 participants
Revert "Skip some HAProxy tests on FIPS"
This reverts #26800.
test/extended/util/url: Usecurl --connect-totest/extended/util/url/url.go(CURL):Add a newProxyHostfield.(
Through): Assign the given address toProxyHostinstead of changing the request host or headers.(
ToShell): Use Curl's--connect-toflag to specify the proxy host.Fix HAProxy tests on FIPS properly
Change existing HAProxy tests to use a FIPS-compatible, 2048-bit RSA key. Add a new test to verify that using a FIPS-incompatible, 1024-bit RSA key for the router's default certificate fails on FIPS clusters and succeeds on non-FIPS clusters.
The certificate used in this new test comes from the default certificate that is currently built into the router image (which is why the tests were failing on FIPS). The certificate used for the already existing tests was generated using the following Shell commands on a RHEL 8.4 system with OpenSSL 1.1.1g:
These commands generate a certificate that has the same parameters as the old one except for the serial number, signature algorithm, validity period, and key size.
test/extended/router/certs.go: New file with the new tests.test/extended/testdata/router/router-common.yaml: Change route-1 and route-2 from non-TLS routes to edge-terminated TLS routes withinsecureEdgeTerminationPolicy: Allow.test/extended/testdata/router/router-override-domains.yaml:test/extended/testdata/router/router-override.yaml:test/extended/testdata/router/router-scoped.yaml:test/extended/testdata/router/weighted-router.yaml: Add a parameter for the default certificate with the default value being a certificate with a FIPS-compatible, 2048-bit RSA key.test/extended/testdata/bindata.go:test/extended/util/annotate/generated/zz_generated.annotations.go: Regenerate.test/extended/router: Dump crypto-policy for FIPSUpdate the new tests that use a FIPS-incompatible key to gather and print out the content of
/etc/crypto-policies/back-ends/opensslcnf.configso that the configured crypto-policy can be examined in case of test failures.test/extended/router/certs.go: cat/etc/crypto-policies/back-ends/opensslcnf.configafter each test.