4:34 a.m.
Hi,
While running a test case of adding hosts on ovirt system tests there was a
failure while the following command was executed:
vdsm-tool configure --force
On libvirtd log I found this error:
2021-12-17 00:11:41.753+0000: 28031: error : virNetTLSContextNew:732 :
Unable to generate diffie-hellman parameters: Error in public key
generation.
How would you suggest to debug this failure?
attaching libvirtd & journalctl logs
libvirt version: 7.10.0, package: 1.module_el8.6.0+1046+bd8eec5e
Thanks,
Dana
The error from host deploy log:
"2021-12-17 01":"11":"45 CET - fatal":[
ost-basic-suite-master-host-0
]:"FAILED! =>"{
"changed":true,
"cmd":[
"vdsm-tool",
"configure",
"--force"
],
"delta":"0:00:06.908971",
"end":"2021-12-17 01:11:42.815057",
"msg":"non-zero return code",
"rc":1,
"start":"2021-12-17 01:11:35.906086",
"stderr":"Error: ServiceOperationError: _systemctlStart
failed\nb'Job for libvirtd.service failed because a fatal signal was
delivered causing the control process to dump core.\\nSee \"systemctl
status libvirtd.service\" and \"journalctl -xe\" for details.\\n'
",
"stderr_lines":[
"Error: ServiceOperationError: _systemctlStart failed",
"b'Job for libvirtd.service failed because a fatal signal was
delivered causing the control process to dump core.\\nSee \"systemctl
status libvirtd.service\" and \"journalctl -xe\" for details.\\n'
"
],
"stdout":"\nChecking configuration status...\n\nlvm is configured
for vdsm\nCurrent revision of multipath.conf detected,
preserving\nlibvirt is already configured for vdsm\nSUCCESS: ssl
configured to true. No conflicts\nsanlock is configured for
vdsm\nManaged volume database is already configured\n\nRunning
configure...\nReconfiguration of libvirt is done.\nReconfiguration of
passwd is done.",
"stdout_lines":[
"",
"Checking configuration status...",
"",
"lvm is configured for vdsm",
"Current revision of multipath.conf detected, preserving",
"libvirt is already configured for vdsm",
"SUCCESS: ssl configured to true. No conflicts",
"sanlock is configured for vdsm",
"Managed volume database is already configured",
"",
"Running configure...",
"Reconfiguration of libvirt is done.",
"Reconfiguration of passwd is done."
]
}
3:02 a.m.
On 12/20/21 11:34, Dana Elfassy wrote:
Hi,
While running a test case of adding hosts on ovirt system tests there
was a failure while the following command was executed:
vdsm-tool configure --force
On libvirtd log I found this error:
2021-12-17 00:11:41.753+0000: 28031: error : virNetTLSContextNew:732 :
Unable to generate diffie-hellman parameters: Error in public key
generation.
This is the code on that line:
err = gnutls_dh_params_init(&ctxt->dhParams);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to initialize diffie-hellman parameters: %s"),
gnutls_strerror(err));
goto error;
}
err = gnutls_dh_params_generate2(ctxt->dhParams, DH_BITS);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to generate diffie-hellman parameters: %s"),
gnutls_strerror(err));
goto error;
}
gnutls_certificate_set_dh_params(ctxt->x509cred,
ctxt->dhParams);
More specific, it's gnutls_dh_params_generate2() that fails. I suspect
it's because DH_BITS is defined as following:
#define DH_BITS 2048
which might be too short for system policy. If you're able, you can try
the following patch:
diff --git i/src/rpc/virnettlscontext.c w/src/rpc/virnettlscontext.c
index 1a3dd92676..3ab9f6c4ce 100644
--- i/src/rpc/virnettlscontext.c
+++ w/src/rpc/virnettlscontext.c
@@ -717,16 +717,20 @@ static virNetTLSContext *virNetTLSContextNew(const char *cacert,
* once a day, once a week or once a month. Depending on the
* security requirements.
*/
if (isServer) {
+ unsigned int bits = 0;
+
+ bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_HIGH);
+
err = gnutls_dh_params_init(&ctxt->dhParams);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to initialize diffie-hellman parameters:
%s"),
gnutls_strerror(err));
goto error;
}
- err = gnutls_dh_params_generate2(ctxt->dhParams, DH_BITS);
+ err = gnutls_dh_params_generate2(ctxt->dhParams, bits);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to generate diffie-hellman parameters:
%s"),
gnutls_strerror(err));
If it helps, I can post it for review.
Michal
1:44 a.m.
Thanks,
Is it possible that you create an rpm with this fix so I can use it on the
test runs and try to reproduce?
On Tue, Dec 21, 2021 at 11:02 AM Michal Prívozník <mprivozn(a)redhat.com>
wrote:
On 12/20/21 11:34, Dana Elfassy wrote:
> Hi,
> While running a test case of adding hosts on ovirt system tests there
> was a failure while the following command was executed:
> vdsm-tool configure --force
>
> On libvirtd log I found this error:
>
> 2021-12-17 00:11:41.753+0000: 28031: error : virNetTLSContextNew:732 :
> Unable to generate diffie-hellman parameters: Error in public key
> generation.
This is the code on that line:
err = gnutls_dh_params_init(&ctxt->dhParams);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to initialize diffie-hellman parameters:
%s"),
gnutls_strerror(err));
goto error;
}
err = gnutls_dh_params_generate2(ctxt->dhParams, DH_BITS);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to generate diffie-hellman parameters: %s"),
gnutls_strerror(err));
goto error;
}
gnutls_certificate_set_dh_params(ctxt->x509cred,
ctxt->dhParams);
More specific, it's gnutls_dh_params_generate2() that fails. I suspect
it's because DH_BITS is defined as following:
#define DH_BITS 2048
which might be too short for system policy. If you're able, you can try
the following patch:
diff --git i/src/rpc/virnettlscontext.c w/src/rpc/virnettlscontext.c
index 1a3dd92676..3ab9f6c4ce 100644
--- i/src/rpc/virnettlscontext.c
+++ w/src/rpc/virnettlscontext.c
@@ -717,16 +717,20 @@ static virNetTLSContext *virNetTLSContextNew(const
char *cacert,
* once a day, once a week or once a month. Depending on the
* security requirements.
*/
if (isServer) {
+ unsigned int bits = 0;
+
+ bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH,
GNUTLS_SEC_PARAM_HIGH);
+
err = gnutls_dh_params_init(&ctxt->dhParams);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to initialize diffie-hellman
parameters: %s"),
gnutls_strerror(err));
goto error;
}
- err = gnutls_dh_params_generate2(ctxt->dhParams, DH_BITS);
+ err = gnutls_dh_params_generate2(ctxt->dhParams, bits);
if (err < 0) {
virReportError(VIR_ERR_SYSTEM_ERROR,
_("Unable to generate diffie-hellman
parameters: %s"),
gnutls_strerror(err));
If it helps, I can post it for review.
Michal
6:04 a.m.
sorry, I missed your last reply
I didn't reproduce it yet, but fedora rpm would be great. just in case
thanks
On Thu, Dec 23, 2021 at 7:04 AM Michal Prívozník <mprivozn(a)redhat.com>
wrote:
On 12/22/21 08:44, Dana Elfassy wrote:
> Thanks,
> Is it possible that you create an rpm with this fix so I can use it on
> the test runs and try to reproduce?
Oh, sure. Is fedora rpm fine?
Michal
8:08 a.m.
On 1/10/22 13:04, Dana Elfassy wrote:
sorry, I missed your last reply
I didn't reproduce it yet, but fedora rpm would be great. just in case
thanks
Here you go:
https://koji.fedoraproject.org/koji/buildinfo?buildID=1867760
Michal
8:09 a.m.
On 1/10/22 15:08, Michal Prívozník wrote:
On 1/10/22 13:04, Dana Elfassy wrote:
> sorry, I missed your last reply
> I didn't reproduce it yet, but fedora rpm would be great. just in case
> thanks
>
Here you go:
Ooops, wrong link. This one is correct:
https://koji.fedoraproject.org/koji/taskinfo?taskID=81062331
Michal
4:13 a.m.
In the last one I don't see a link to download the RPM, can you check?
On Mon, Jan 10, 2022 at 4:10 PM Michal Prívozník <mprivozn(a)redhat.com>
wrote:
On 1/10/22 15:08, Michal Prívozník wrote:
> On 1/10/22 13:04, Dana Elfassy wrote:
>> sorry, I missed your last reply
>> I didn't reproduce it yet, but fedora rpm would be great. just in case
>> thanks
>>
>
> Here you go:
>
Ooops, wrong link. This one is correct:
https://koji.fedoraproject.org/koji/taskinfo?taskID=81062331
Michal
5:46 a.m.
On 1/11/22 11:13, Dana Elfassy wrote:
In the last one I don't see a link to download the RPM, can you
check?
You have to click on the arch you are interested in, for instance x86_64
is the following link:
https://koji.fedoraproject.org/koji/taskinfo?taskID=81062428
And if you don't want to download all rpms by hand you can use koji:
koji download-task 81062428
Just replace the task ID with the one you want to download. The example
will download rpms for x86_64.
Michal
1046
days inactive
1068
days old
8 comments
2 participants
participants (2)
-
Dana Elfassy -
Michal Prívozník