Skip to content

Commit 5ff584d

Browse files
pirat89pirat89
committed
Add actors for OpenSSL conf and IBMCA
* The openssl-ibmca needs to be reconfigured manually after the upgrade. Report it to the user if the package is installed. * The openssl configuration file (/etc/pki/tls/openssl.cnf) is not 100% compatible between major verions of RHEL due to different versions of OpenSSL. Also the configuration is supposed to be done via system wide crypto policies instead, so it's expected to not modify this file anymore. If the content of the file has been modified, report to user what will happen during the upgrade and what they should do after it. * If the openssl config file is modified (rpm -Vf <file>) and *.rpmnew file exists, back up the file with .leappsave suffix and replace it by the *.rpmsave one.
1 parent cda8ebe commit 5ff584d

File tree

7 files changed

+496
-0
lines changed

7 files changed

+496
-0
lines changed

‎repos/system_upgrade/common/actors/openssl/checkopensslconf/actor.py

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
from leapp.actors import Actor
2+
from leapp.libraries.actor import checkopensslconf
3+
from leapp.models import DistributionSignedRPM, Report, TrackedFilesInfoSource
4+
from leapp.tags import ChecksPhaseTag, IPUWorkflowTag
5+
6+
7+
class CheckOpenSSLConf(Actor):
8+
"""
9+
Check whether the openssl configuration and openssl-IBMCA.
10+
11+
See the report messages for more details. The summary is that since RHEL 8
12+
it's expected to configure OpenSSL via crypto policies. Also, OpenSSL has
13+
different versions between major versions of RHEL:
14+
* RHEL 7: 1.0,
15+
* RHEL 8: 1.1,
16+
* RHEL 9: 3.0
17+
So OpenSSL configuration from older system does not have to be 100%
18+
compatible with the new system. In some cases, the old configuration could
19+
make the system inaccessible remotely. So new approach is to ensure the
20+
upgraded system will use always new default /etc/pki/tls/openssl.cnf
21+
configuration file (the original one will be backed up if modified by user).
22+
23+
Similar for OpenSSL-IBMCA, when it's expected to configure it again on
24+
each newer system.
25+
"""
26+
27+
name = 'check_openssl_conf'
28+
consumes = (DistributionSignedRPM, TrackedFilesInfoSource)
29+
produces = (Report,)
30+
tags = (IPUWorkflowTag, ChecksPhaseTag)
31+
32+
def process(self):
33+
checkopensslconf.process()

‎repos/system_upgrade/common/actors/openssl/checkopensslconf/libraries/checkopensslconf.py

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
from leapp import reporting
2+
from leapp.libraries.common.config import architecture, version
3+
from leapp.libraries.common.rpms import has_package
4+
from leapp.libraries.stdlib import api
5+
from leapp.models import DistributionSignedRPM, TrackedFilesInfoSource
6+
7+
DEFAULT_OPENSSL_CONF = '/etc/pki/tls/openssl.cnf'
8+
URL_8_CRYPTOPOLICIES = 'https://red.ht/rhel-8-system-wide-crypto-policies'
9+
URL_9_CRYPTOPOLICIES = 'https://red.ht/rhel-9-system-wide-crypto-policies'
10+
11+
12+
def check_ibmca():
13+
if not architecture.matches_architecture(architecture.ARCH_S390X):
14+
# not needed check really, but keeping it to make it clear
15+
return
16+
if not has_package(DistributionSignedRPM, 'openssl-ibmca'):
17+
return
18+
# In RHEL 9 has been introduced new technology: openssl providers. The engine
19+
# is deprecated, so keep proper teminology to not confuse users.
20+
dst_tech = 'engine' if version.get_target_major_version() == '8' else 'providers'
21+
summary = (
22+
'The presence of openssl-ibmca package suggests that the system may be configured'
23+
' to use the IBMCA OpenSSL engine.'
24+
' Due to major changes in OpenSSL and libica between RHEL {source} and RHEL {target} it is not'
25+
' possible to migrate OpenSSL configuration files automatically. Therefore,'
26+
' it is necessary to enable IBMCA {tech} in the OpenSSL config file manually'
27+
' after the system upgrade.'
28+
.format(
29+
source=version.get_source_major_version(),
30+
target=version.get_target_major_version(),
31+
tech=dst_tech
32+
)
33+
)
34+
35+
hint = (
36+
'Configure the IBMCA {tech} manually after the upgrade.'
37+
' Please, be aware that it is not recommended to configure the system default'
38+
' {fpath}. Instead, it is recommended to configure a copy of'
39+
' that file and use this copy only for particular applications that are supposed'
40+
' to utilize the IBMCA {tech}. The location of the OpenSSL configuration file'
41+
' can be specified using the OPENSSL_CONF environment variable.'
42+
.format(tech=dst_tech, fpath=DEFAULT_OPENSSL_CONF)
43+
)
44+
45+
reporting.create_report([
46+
reporting.Title('Detected possible use of IBMCA in OpenSSL'),
47+
reporting.Summary(summary),
48+
reporting.Remediation(hint=hint),
49+
reporting.Severity(reporting.Severity.MEDIUM),
50+
reporting.Groups([
51+
reporting.Groups.POST,
52+
reporting.Groups.ENCRYPTION
53+
]),
54+
])
55+
56+
57+
def _is_openssl_modified():
58+
tracked_files = next(api.consume(TrackedFilesInfoSource), None)
59+
if not tracked_files:
60+
# unexpected at all, skipping testing, but keeping the log just in case
61+
api.current_logger.warning('The TrackedFilesInfoSource message is missing! Skipping check of openssl config.')
62+
return False
63+
for finfo in tracked_files.files:
64+
if finfo.path == DEFAULT_OPENSSL_CONF:
65+
return finfo.is_modified
66+
return False
67+
68+
69+
def check_default_openssl():
70+
if not _is_openssl_modified():
71+
return
72+
73+
crypto_url = URL_8_CRYPTOPOLICIES if version.get_target_major_version == '8' else URL_9_CRYPTOPOLICIES
74+
75+
# TODO(pstodulk): Needs in future some rewording, as OpenSSL engines are
76+
# deprecated since "RHEL 8" and people should use OpenSSL providers instead.
77+
# (IIRC, they are required to use OpenSSL providers since RHEL 9.) The
78+
# current wording could be inaccurate.
79+
summary = (
80+
'The OpenSSL configuration file ({fpath}) has been'
81+
' modified on the system. RHEL 8 (and newer) systems provide a crypto-policies'
82+
' mechanism ensuring usage of system-wide secure cryptography algorithms.'
83+
' Also the target system uses newer version of OpenSSL that is not fully'
84+
' compatible with the current one.'
85+
' To ensure the upgraded system uses crypto-policies as expected,'
86+
' the new version of the openssl configuration file must be installed'
87+
' during the upgrade. This will be done automatically.'
88+
' The original configuration file will be saved'
89+
' as "{fpath}.leappsave".'
90+
'\n\nNote this can affect the ability to connect to the system after'
91+
' the upgrade if it depends on the current OpenSSL configuration.'
92+
' Such a problem may be caused by using a particular OpenSSL engine, as'
93+
' OpenSSL engines built for the'
94+
' RHEL {source} system are not compatible with RHEL {target}.'
95+
.format(
96+
fpath=DEFAULT_OPENSSL_CONF,
97+
source=version.get_source_major_version(),
98+
target=version.get_target_major_version()
99+
)
100+
)
101+
if version.get_target_major_version() == '9':
102+
# NOTE(pstodulk): that a try to make things with engine/providers a
103+
# little bit better (see my TODO note above)
104+
summary += (
105+
'\n\nNote the legacy ENGINE API is deprecated since RHEL 8 and'
106+
' it is required to use the new OpenSSL providers API instead on'
107+
' RHEL 9 systems.'
108+
)
109+
hint = (
110+
'Check that your ability to login to the system does not depend on'
111+
' the OpenSSL configuration. After the upgrade, review the system configuration'
112+
' and configure the system as needed.'
113+
' Please, be aware that it is not recommended to configure the system default'
114+
' {fpath}. Instead, it is recommended to copy the file and use this copy'
115+
' to configure particular applications.'
116+
' The default OpenSSL configuration file should be modified only'
117+
' when it is really necessary.'
118+
)
119+
reporting.create_report([
120+
reporting.Title('The /etc/pki/tls/openssl.cnf file is modified and will be replaced during the upgrade.'),
121+
reporting.Summary(summary),
122+
reporting.Remediation(hint=hint),
123+
reporting.Severity(reporting.Severity.HIGH),
124+
reporting.Groups([reporting.Groups.POST, reporting.Groups.SECURITY]),
125+
reporting.RelatedResource('file', DEFAULT_OPENSSL_CONF),
126+
reporting.ExternalLink(
127+
title='Using system-wide cryptographic policies.',
128+
url=crypto_url
129+
)
130+
])
131+
132+
133+
def process():
134+
check_ibmca()
135+
check_default_openssl()

‎repos/system_upgrade/common/actors/openssl/checkopensslconf/tests/unit_test_checkopensslconf.py

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
import pytest
2+
3+
from leapp import reporting
4+
from leapp.libraries.actor import checkopensslconf
5+
from leapp.libraries.common.config import architecture
6+
from leapp.libraries.common.testutils import create_report_mocked, CurrentActorMocked, logger_mocked
7+
from leapp.libraries.stdlib import api
8+
from leapp.models import DistributionSignedRPM, FileInfo, RPM, TrackedFilesInfoSource
9+
10+
_DUMP_PKG_NAMES = ['random', 'pkgs', 'openssl-ibmca-nope', 'ibmca', 'nope-openssl-ibmca']
11+
_SSL_CONF = checkopensslconf.DEFAULT_OPENSSL_CONF
12+
13+
14+
def _msg_pkgs(pkgnames):
15+
rpms = []
16+
for pname in pkgnames:
17+
rpms.append(RPM(
18+
name=pname,
19+
epoch='0',
20+
version='1.0',
21+
release='1',
22+
arch='noarch',
23+
pgpsig='RSA/SHA256, Mon 01 Jan 1970 00:00:00 AM -03, Key ID 199e2f91fd431d51',
24+
packager='Red Hat, Inc. (auxiliary key 2) <[email protected]>'
25+
26+
))
27+
return DistributionSignedRPM(items=rpms)
28+
29+
30+
@pytest.mark.parametrize('arch,pkgnames,ibmca_report', (
31+
(architecture.ARCH_S390X, [], False),
32+
(architecture.ARCH_S390X, _DUMP_PKG_NAMES, False),
33+
(architecture.ARCH_S390X, ['openssl-ibmca'], True),
34+
(architecture.ARCH_S390X, _DUMP_PKG_NAMES + ['openssl-ibmca'], True),
35+
(architecture.ARCH_S390X, ['openssl-ibmca'] + _DUMP_PKG_NAMES, True),
36+
37+
# stay false for non-IBM-z arch - invalid scenario basically
38+
(architecture.ARCH_X86_64, ['openssl-ibmca'], False),
39+
(architecture.ARCH_PPC64LE, ['openssl-ibmca'], False),
40+
(architecture.ARCH_ARM64, ['openssl-ibmca'], False),
41+
42+
))
43+
@pytest.mark.parametrize('src_maj_ver', ('7', '8', '9'))
44+
def test_check_ibmca(monkeypatch, src_maj_ver, arch, pkgnames, ibmca_report):
45+
monkeypatch.setattr(reporting, "create_report", create_report_mocked())
46+
monkeypatch.setattr(api, 'current_actor', CurrentActorMocked(
47+
arch=arch,
48+
msgs=[_msg_pkgs(pkgnames)],
49+
src_ver='{}.6'.format(src_maj_ver),
50+
dst_ver='{}.0'.format(int(src_maj_ver) + 1)
51+
))
52+
checkopensslconf.check_ibmca()
53+
54+
if not ibmca_report:
55+
assert not reporting.create_report.called, 'IBMCA report created when it should not.'
56+
else:
57+
assert reporting.create_report.called, 'IBMCA report has not been created.'
58+
59+
60+
def _msg_files(fnames_changed, fnames_untouched):
61+
res = []
62+
for fname in fnames_changed:
63+
res.append(FileInfo(
64+
path=fname,
65+
exists=True,
66+
is_modified=True
67+
))
68+
69+
for fname in fnames_untouched:
70+
res.append(FileInfo(
71+
path=fname,
72+
exists=True,
73+
is_modified=False
74+
))
75+
76+
return TrackedFilesInfoSource(files=res)
77+
78+
79+
# NOTE(pstodulk): Ignoring situation when _SSL_CONF is missing (modified, do not exists).
80+
# It's not a valid scenario actually, as this file just must exists on the system to
81+
# consider it in a supported state.
82+
@pytest.mark.parametrize('msg,openssl_report', (
83+
# matrix focused on openssl reports only (positive)
84+
(_msg_files([], []), False),
85+
(_msg_files([_SSL_CONF], []), True),
86+
(_msg_files(['what/ever', _SSL_CONF, 'something'], []), True),
87+
(_msg_files(['what/ever'], [_SSL_CONF]), False),
88+
))
89+
@pytest.mark.parametrize('src_maj_ver', ('7', '8', '9'))
90+
def test_check_openssl(monkeypatch, src_maj_ver, msg, openssl_report):
91+
monkeypatch.setattr(reporting, "create_report", create_report_mocked())
92+
monkeypatch.setattr(api, 'current_actor', CurrentActorMocked(
93+
msgs=[msg],
94+
src_ver='{}.6'.format(src_maj_ver),
95+
dst_ver='{}.0'.format(int(src_maj_ver) + 1)
96+
))
97+
checkopensslconf.process()
98+
99+
if not openssl_report:
100+
assert not reporting.create_report.called, 'OpenSSL report created when it should not.'
101+
else:
102+
assert reporting.create_report.called, 'OpenSSL report has not been created.'

‎repos/system_upgrade/common/actors/openssl/migrateopensslconf/actor.py

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
from leapp.actors import Actor
2+
from leapp.libraries.actor import migrateopensslconf
3+
from leapp.tags import ApplicationsPhaseTag, IPUWorkflowTag
4+
5+
6+
class MigrateOpenSslConf(Actor):
7+
"""
8+
Enforce the target default configuration file to be used.
9+
10+
If the /etc/pki/tls/openssl.cnf has been modified and openssl.cnf.rpmnew
11+
file is created, backup the original one and replace it by the new default.
12+
13+
tl;dr:
14+
if the file is modified; then
15+
mv /etc/pki/tls/openssl.cnf{,rpmsave_leapp}
16+
mv /etc/pki/tls/openssl.cnf{.rpmnew,}
17+
fi
18+
"""
19+
20+
name = 'migrate_openssl_conf'
21+
consumes = ()
22+
produces = ()
23+
tags = (IPUWorkflowTag, ApplicationsPhaseTag)
24+
25+
def process(self):
26+
migrateopensslconf.process()

‎repos/system_upgrade/common/actors/openssl/migrateopensslconf/libraries/migrateopensslconf.py

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
import os
2+
3+
from leapp.libraries.stdlib import api, CalledProcessError, run
4+
5+
DEFAULT_OPENSSL_CONF = '/etc/pki/tls/openssl.cnf'
6+
OPENSSL_CONF_RPMNEW = '{}.rpmnew'.format(DEFAULT_OPENSSL_CONF)
7+
OPENSSL_CONF_BACKUP = '{}.leappsave'.format(DEFAULT_OPENSSL_CONF)
8+
9+
10+
def _is_openssl_modified():
11+
"""
12+
Return True if modified in any way
13+
"""
14+
# NOTE(pstodulk): this is different from the approach in scansourcefiles,
15+
# where we are interested about modified content. In this case, if the
16+
# file is modified in any way, let's do something about that..
17+
try:
18+
run(['rpm', '-Vf', DEFAULT_OPENSSL_CONF])
19+
except CalledProcessError:
20+
return True
21+
return False
22+
23+
24+
def _safe_mv_file(src, dst):
25+
"""
26+
Move the file from src to dst. Return True on success, otherwise False.
27+
"""
28+
try:
29+
run(['mv', src, dst])
30+
except CalledProcessError:
31+
return False
32+
return True
33+
34+
35+
def process():
36+
if not _is_openssl_modified():
37+
return
38+
if not os.path.exists(OPENSSL_CONF_RPMNEW):
39+
api.current_logger().debug('The {} file is modified, but *.rpmsave not found. Cannot do anything.')
40+
return
41+
if not _safe_mv_file(DEFAULT_OPENSSL_CONF, OPENSSL_CONF_BACKUP):
42+
# NOTE(pstodulk): One of reasons could be the file is missing, however
43+
# that's not expected to happen at all. If the file is missing before
44+
# the upgrade, it will be installed by new openssl* package
45+
api.current_logger().error(
46+
'Could not back up the {} file. Skipping other actions.'
47+
.format(DEFAULT_OPENSSL_CONF)
48+
)
49+
return
50+
if not _safe_mv_file(OPENSSL_CONF_RPMNEW, DEFAULT_OPENSSL_CONF):
51+
# unexpected, it's double seatbelt
52+
api.current_logger().error('Cannot apply the new openssl configuration file! Restore it from the backup.')
53+
if not _safe_mv_file(OPENSSL_CONF_BACKUP, DEFAULT_OPENSSL_CONF):
54+
api.current_logger().error('Cannot restore the openssl configuration file!')

0 commit comments

Comments
 (0)