systemd: fix services to allow TLS configurations via java.security.ciphers by yadvr · Pull Request #3163 · apache/cloudstack

yadvr · 2019-02-04T07:05:47Z

This fixes the management server and systemd services to allow the
java.security.ciphers file to configure disabled TLS protocols and
algorithms. This also cleans up systemd service files for agent and
usage server, and deprecates use of jsvc when systemd can be used
directly.

This fixes #3140

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)

How Has This Been Tested?

Deploy systemd based environments using CentOS7 and Ubuntu 18.04. Verified first that TLS settings has no effect, then with the changes applied found in both usage, kvm agent and management server that systemd service works OK and TLS was configurable again.

…iphers This fixes the management server and systemd services to allow the java.security.ciphers file to configure disabled TLS protocols and algorithms. This also cleans up systemd service files for agent and usage server. This fixes apache#3140 Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

yadvr · 2019-02-04T07:14:43Z

@blueorangutan package

blueorangutan · 2019-02-04T07:15:33Z

@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2019-02-04T07:34:12Z

Packaging result: ✔centos6 ✔centos7 ✔debian. JID-2594

yadvr · 2019-02-04T07:36:26Z

@blueorangutan test matrix

blueorangutan · 2019-02-04T07:36:33Z

@rhtyd a Trillian-Jenkins matrix job (centos6 mgmt + xs71, centos7 mgmt + vmware65, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests

yadvr · 2019-02-04T07:37:19Z

@GabrielBrascher please consider including this in 4.12.0.0 as this fixes the TLS configuration security issue.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

wido

LGTM

yadvr · 2019-02-04T10:47:51Z

Forward merging-note: master does not support ubuntu 14.04 and older, therefore jsvc dependency can be removed from master's debian/.

blueorangutan · 2019-02-04T14:56:33Z

Trillian test result (tid-3371)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 24936 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr3163-t3371-kvm-centos7.zip
Intermittent failure detected: /marvin/tests/smoke/test_deploy_virtio_scsi_vm.py
Intermittent failure detected: /marvin/tests/smoke/test_vpc_redundant.py
Intermittent failure detected: /marvin/tests/smoke/test_vpc_vpn.py
Smoke tests completed. 67 look OK, 1 have error(s)
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_01_redundant_vpc_site2site_vpn	`Failure`	205.85	test_vpc_vpn.py

blueorangutan · 2019-02-04T15:20:13Z

Trillian test result (tid-3372)
Environment: vmware-65 (x2), Advanced Networking with Mgmt server 7
Total time taken: 26302 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr3163-t3372-vmware-65.zip
Smoke tests completed. 68 look OK, 0 have error(s)
Only failed tests results shown below:

Test	Result	Time (s)	Test File

GabrielBrascher · 2019-02-04T16:15:48Z

We are on tight schedule for 4.12; thus, I am trying to keep as short as possible the list of PRs aiming the 4.12 release.

Considering this; @rhtyd do you think that this PR is a blocker for 4.12? If so, could you please register this PR as a blocker on the mailing list thread '[PROPOSE] RM for 4.12'? Thanks!

yadvr · 2019-02-04T16:34:05Z

Yes @GabrielBrascher because the tls disabled settings is no longer honoured, it's a security issue. Will propose on the list.

# Conflicts: # packaging/debian/init/cloud-management # packaging/systemd/cloudstack-agent.default # packaging/systemd/cloudstack-agent.service # packaging/systemd/cloudstack-management.service

borisstoyanov

LGTM, run manual testing and could confirm that secure renegotiation is not supported with tls1 and tls1_1

This fixes regression introduced by refactoring PR apache#3163 where `-Dpid` was incorrectly passed string `$$` instead of parent PID integer. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

* systemd: Fix -Dpid arg passing to systemd usage service This fixes regression introduced by refactoring PR #3163 where `-Dpid` was incorrectly passed string `$$` instead of parent PID integer. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * fix systemd limitation, exec using /bin/sh instead and wrap in ${} syntax https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * usage: don't hide exception from Gabriel's https://github.com/apache/cloudstack/pull/3207/files#diff-062fcf5ae32de59dfd6cd4f780e1d7cd Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

* systemd: Fix -Dpid arg passing to systemd usage service This fixes regression introduced by refactoring PR apache#3163 where `-Dpid` was incorrectly passed string `$$` instead of parent PID integer. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * fix systemd limitation, exec using /bin/sh instead and wrap in ${} syntax https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * usage: don't hide exception from Gabriel's https://github.com/apache/cloudstack/pull/3207/files#diff-062fcf5ae32de59dfd6cd4f780e1d7cd Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

…iphers (apache#3163) * systemd: fix services to allow TLS configurations via java.security.ciphers This fixes the management server and systemd services to allow the java.security.ciphers file to configure disabled TLS protocols and algorithms. This also cleans up systemd service files for agent and usage server. This fixes apache#3140 Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * configure: fix travis failure due pycodestyle error Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> (cherry picked from commit cb3fed0) Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

* systemd: Fix -Dpid arg passing to systemd usage service This fixes regression introduced by refactoring PR apache#3163 where `-Dpid` was incorrectly passed string `$$` instead of parent PID integer. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * fix systemd limitation, exec using /bin/sh instead and wrap in ${} syntax https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * usage: don't hide exception from Gabriel's https://github.com/apache/cloudstack/pull/3207/files#diff-062fcf5ae32de59dfd6cd4f780e1d7cd Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> (cherry picked from commit f7327c7) Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

* systemd: Fix -Dpid arg passing to systemd usage service This fixes regression introduced by refactoring PR apache#3163 where `-Dpid` was incorrectly passed string `$$` instead of parent PID integer. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * fix systemd limitation, exec using /bin/sh instead and wrap in ${} syntax https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> * usage: don't hide exception from Gabriel's https://github.com/apache/cloudstack/pull/3207/files#diff-062fcf5ae32de59dfd6cd4f780e1d7cd Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

yadvr requested review from GabrielBrascher, PaulAngus, rafaelweingartner and wido February 4, 2019 07:05

yadvr force-pushed the javasecurity-fix-systemd branch from eaf0656 to 4303ec1 Compare February 4, 2019 07:08

yadvr added type:security component:systemd type:cleanup labels Feb 4, 2019

yadvr added this to the 4.11.3.0 milestone Feb 4, 2019

yadvr added the Severity:BLOCKER label Feb 4, 2019

configure: fix travis failure due pycodestyle error

5af8829

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

wido approved these changes Feb 4, 2019

View reviewed changes

apache deleted a comment from blueorangutan Feb 4, 2019

GabrielBrascher merged commit cb3fed0 into apache:4.11 Feb 4, 2019

yadvr mentioned this pull request Feb 5, 2019

debian: cleanup commons-daemon no longer needed by agent #3165

Merged

5 tasks

borisstoyanov reviewed Feb 8, 2019

View reviewed changes

yadvr mentioned this pull request Mar 12, 2019

systemd: Fix -Dpid arg passing to systemd usage service #3210

Merged

5 tasks

Conversation

yadvr commented Feb 4, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Types of changes

How Has This Been Tested?

Uh oh!

yadvr commented Feb 4, 2019

Uh oh!

blueorangutan commented Feb 4, 2019

Uh oh!

blueorangutan commented Feb 4, 2019

Uh oh!

yadvr commented Feb 4, 2019

Uh oh!

blueorangutan commented Feb 4, 2019

Uh oh!

yadvr commented Feb 4, 2019

Uh oh!

wido left a comment

Choose a reason for hiding this comment

Uh oh!

yadvr commented Feb 4, 2019

Uh oh!

blueorangutan commented Feb 4, 2019

Uh oh!

blueorangutan commented Feb 4, 2019

Uh oh!

GabrielBrascher commented Feb 4, 2019

Uh oh!

yadvr commented Feb 4, 2019

Uh oh!

borisstoyanov left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

yadvr commented Feb 4, 2019 •

edited

Loading