| *** everjeje has quit IRC | 00:16 | |
| *** crc32 has quit IRC | 01:25 | |
| dave-mccowan | alee ping | 01:47 |
|---|---|---|
| *** kebray has quit IRC | 01:58 | |
| *** tkelsey has joined #openstack-barbican | 02:30 | |
| *** tkelsey has quit IRC | 02:34 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Add Functional Test for Private Key Secret Type https://review.openstack.org/169974 | 02:41 |
| *** crc32 has joined #openstack-barbican | 02:56 | |
| *** rm_work|away is now known as rm_work | 03:31 | |
| *** jamielennox is now known as jamielennox|away | 03:51 | |
| *** woodster_ has quit IRC | 04:00 | |
| *** tkelsey has joined #openstack-barbican | 04:31 | |
| *** rm_work is now known as rm_work|away | 04:32 | |
| *** woodster_ has joined #openstack-barbican | 04:35 | |
| *** tkelsey has quit IRC | 04:35 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding ACL db model changes (Part 1) https://review.openstack.org/164334 | 05:42 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding ACL db repository changes (Part 2) https://review.openstack.org/167712 | 05:42 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding Secret ACL controller layer changes (Part 3) https://review.openstack.org/164335 | 05:43 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding Container ACL controller layer changes (Part 4) https://review.openstack.org/165205 | 05:43 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding policy layer changes for ACL support (Part 5) https://review.openstack.org/165207 | 05:43 |
| *** Nirupama has joined #openstack-barbican | 05:57 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Implement validators and tests for stored key certificate orders https://review.openstack.org/167291 | 06:00 |
| *** dave-mccowan has quit IRC | 06:08 | |
| *** crc32 has quit IRC | 06:28 | |
| *** woodster_ has quit IRC | 06:40 | |
| *** tkelsey has joined #openstack-barbican | 06:41 | |
| *** tkelsey has quit IRC | 06:42 | |
| *** rm_work|away is now known as rm_work | 06:51 | |
| *** chlong has quit IRC | 06:55 | |
| *** darrenmoffat has quit IRC | 10:14 | |
| *** darrenmoffat has joined #openstack-barbican | 10:15 | |
| *** jaosorior has joined #openstack-barbican | 10:19 | |
| *** alee has quit IRC | 12:11 | |
| *** woodster_ has joined #openstack-barbican | 12:27 | |
| *** dave-mccowan has joined #openstack-barbican | 12:28 | |
| *** chlong has joined #openstack-barbican | 13:01 | |
| *** Nirupama has quit IRC | 13:05 | |
| *** joesavak has joined #openstack-barbican | 13:15 | |
| *** alee has joined #openstack-barbican | 13:31 | |
| *** zigo_ is now known as zigo | 13:41 | |
| *** zz_dimtruck is now known as dimtruck | 13:46 | |
| *** chlong has quit IRC | 13:47 | |
| *** everjeje has joined #openstack-barbican | 13:55 | |
| dave-mccowan | alee good morning | 13:57 |
| alee | dave-mccowan, morning | 13:59 |
| dave-mccowan | alee i wrote a new function test, that's really a bug report. https://review.openstack.org/169974 This test fails for me. I think if it worked, then your tests would also work. i think it might also fail on openssl 1.0+ too. | 14:01 |
| alee | dave-mccowan, looking | 14:02 |
| alee | dave-mccowan, so -- the secret that is returned -- is it pem format? | 14:04 |
| alee | dave-mccowan, or binary? | 14:04 |
| dave-mccowan | PEM, including header/footer and newlines every 80 chars or so. | 14:04 |
| alee | dave-mccowan, does it load? | 14:05 |
| alee | dave-mccowan, (I guess that as the test fails, the secret is not the same) | 14:05 |
| *** paul_glass has joined #openstack-barbican | 14:06 | |
| dave-mccowan | alee, first call to load_privatekey() works, second call to load_privatekey() fails. assertEquals() also fails. | 14:06 |
| alee | dave-mccowan, I'm curious what would happen if you used pycrypto and pkcs8 format to generate the key | 14:07 |
| dave-mccowan | alee, i'm curious if load() works on openssl 1.0+. it seems that it's a "feature" that load() works with a mangled key, vs. a bug when it fails. | 14:07 |
| alee | dave-mccowan, I'll try it out and let you know shortly | 14:07 |
| alee | dave-mccowan, but try out the pkcs8 thing -- I'm curious if that works because we use pkcs8 to store in the plugin | 14:08 |
| alee | so those should be the same | 14:09 |
| dave-mccowan | alee, quick question on my validators CR: I used mock in test_validators. is that no-no? (i'm fixing up the last couple lines of missed coverage now) | 14:09 |
| alee | dave-mccowan, depends on what you are mocking | 14:10 |
| alee | if its a repo, then thats frowned upon. | 14:10 |
| alee | dave-mccowan, that said - its a unit test | 14:10 |
| alee | so having enormous amounts of setup --especially for validators does not make a lot of sense. | 14:11 |
| dave-mccowan | alee, yea, it's a repo. <frown> but, functional tests have complete coverage. | 14:11 |
| alee | dave-mccowan, yeah - but functional tests are not counted in coverage | 14:11 |
| dave-mccowan | alee, i'm doing it the right way in test_orders now, to get missing coverage. so, i should be able to port it over to test_validators pretty easily. | 14:13 |
| dave-mccowan | alee, if i get coverage through test_orders.py, will that "count" for coverage in validators.py? | 14:15 |
| alee | dave-mccowan, sure. as long as some coverage happens in the unit tests anywhere, its fine. | 14:16 |
| *** ametts has joined #openstack-barbican | 14:18 | |
| *** jorge_munoz has quit IRC | 14:23 | |
| *** kebray has joined #openstack-barbican | 14:31 | |
| *** xaeth_afk is now known as xaeth | 14:49 | |
| *** kebray has quit IRC | 15:02 | |
| dave-mccowan | alee, store_secrets.py doesn't like plain base64 encoded DER. it looks for PEM headers/footers and raises SecretPayloadDecodingError() when it can't find them. | 15:15 |
| alee | dave-mccowan, ok -- I'm tracing through the code right now and trying to put together a test outside of barbican that can be done. | 15:16 |
| alee | ie. something that does all the things we do to a secret, and sees which operation fails on openssl 0.9.8 | 15:17 |
| reaperhulk | It's going to be DER loading of PKCS8 without password | 15:19 |
| *** kebray has joined #openstack-barbican | 15:21 | |
| openstackgerrit | Merged openstack/barbican: Security tests for Container resources https://review.openstack.org/164875 | 15:28 |
| woodster_ | Can folks review this CR? https://review.openstack.org/#/c/168039/ Not merging this will cause problems for production deployments of workers. | 15:31 |
| woodster_ | Likewise, this CR provides proper migration of the retry table: https://review.openstack.org/#/c/169946/ | 15:31 |
| alee | dave-mccowan, I'm wondering if your test is valid in https://review.openstack.org/#/c/169974/ | 15:34 |
| alee | dave-mccowan, specifically, you are sending in "payload_content_encoding" = base64 | 15:35 |
| alee | but thats not true because you're sending in pem which has base64 stuff with headers and footers. | 15:36 |
| dave-mccowan | alee i agree on the semantics. so we don't support PEM? is that a design flaw? | 15:37 |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Add Functional Tests for Private Key Secret Type https://review.openstack.org/169974 | 15:37 |
| alee | dave-mccowan, I'm reading through the code to see what should be in there | 15:38 |
| alee | dave-mccowan, specifically normalize_before_encryption() | 15:38 |
| alee | dave-mccowan, actually I'll take that back -- base64 is correct | 15:39 |
| dave-mccowan | alee, ^^ there's my second tests using pycrypto. the secret store like this format which is PEM-like, but test still fails. | 15:39 |
| openstackgerrit | Merged openstack/barbican: Adding ACL db model changes (Part 1) https://review.openstack.org/164334 | 15:40 |
| *** arunkant_ has joined #openstack-barbican | 15:42 | |
| alee | dave-mccowan, looks like we basically send the secret unchanged to be stored in the plugin with the settings you have | 15:45 |
| alee | ie. with pem headers and all. | 15:46 |
| alee | dave-mccowan, now the return trip .. | 15:46 |
| alee | dave-mccowan, on the return trip , we strip off the pem headers and pass back binary | 15:51 |
| alee | dave-mccowan, so I'm a little confused when you say that what you get back is PEM with header and footer? | 15:54 |
| alee | dave-mccowan, I think you need to use the function _to_pem() | 15:55 |
| alee | on get_resp.content | 15:56 |
| *** tkelsey has joined #openstack-barbican | 15:57 | |
| openstackgerrit | Merged openstack/barbican: Create snakeoil certificate plugin https://review.openstack.org/140575 | 16:00 |
| arunkant_ | alee, thanks for all the reviews. Provided comment on your question on part 2. Please check if its looks okay. | 16:02 |
| alee | arunkant, replied | 16:04 |
| dave-mccowan | alee, lunch time. i'll look again in a bit. | 16:05 |
| alee | arunkant, looks good -- now we just need the other cores to approve .. | 16:05 |
| alee | dave-mccowan, ok | 16:06 |
| alee | woodster_, jvrbanac , hockeynut , redrobot ^^ that means ya'll :) | 16:06 |
| hockeynut | alee still a Texan at heart I see :-) | 16:06 |
| alee | hockeynut, I was totally shocked when I first moved to Texas and I was grading someones grammar test, and they specified the second person plural pronoun as "you all". | 16:08 |
| alee | hockeynut, and then it became second nature | 16:08 |
| hockeynut | it took me about 20 minutes before I started y'alling everyone (since I'm really a NYer) | 16:10 |
| alee | hockeynut, rolls off the tongue a little easier than "youse guys" | 16:10 |
| hockeynut | oh yes | 16:12 |
| hockeynut | so has anyone noticed that if you type LGTM in the review it automatically sets workflow to +1 ? | 16:12 |
| arunkant_ | alee, thanks. | 16:14 |
| alee | arunkant, np - thanks for taking this on :) | 16:14 |
| openstackgerrit | Merged openstack/barbican: Updating Orders functional tests to new naming convention https://review.openstack.org/168485 | 16:23 |
| *** insequent is now known as insequent|class | 16:25 | |
| *** insequent|class is now known as insequent | 16:25 | |
| *** lisaclark_ has joined #openstack-barbican | 16:36 | |
| *** kebray has quit IRC | 16:39 | |
| *** chadlung has joined #openstack-barbican | 16:43 | |
| openstackgerrit | Merged openstack/barbican: Adding ACL db repository changes (Part 2) https://review.openstack.org/167712 | 17:13 |
| *** jkf has joined #openstack-barbican | 17:21 | |
| *** chadlung has quit IRC | 17:27 | |
| dave-mccowan | alee ping | 17:38 |
| *** kebray has joined #openstack-barbican | 17:42 | |
| *** jaosorior has quit IRC | 17:52 | |
| *** kebray has quit IRC | 17:54 | |
| *** kebray has joined #openstack-barbican | 17:54 | |
| *** chadlung has joined #openstack-barbican | 17:55 | |
| alee | dave-mccowan, pong | 17:58 |
| dave-mccowan | alee, have you got the pkcs8 thing figured out? | 17:59 |
| *** tkelsey has quit IRC | 18:00 | |
| alee | dave-mccowan, not just yet - just got back from lunch | 18:00 |
| dave-mccowan | alee, for my private key tests, you think they are "user error"? the caller to get() should expect the response content to be binary? | 18:02 |
| alee | dave-mccowan, yes | 18:03 |
| alee | dave-mccowan, you need to take the data returned, base64 encode it, add the headers and then try the import | 18:03 |
| alee | dave-mccowan, or alternatively try to import it in ASN1 mode. though that did not seem to be working | 18:04 |
| alee | (at least in openssl 0.9.8 | 18:04 |
| alee | dave-mccowan, I'll testing out some new code in generate_csr based on all of this | 18:05 |
| dave-mccowan | alee ok. if i get those to work in the functional test, then we just do the same thing in generate_csr() | 18:05 |
| alee | debugging right now | 18:05 |
| dave-mccowan | alee did you get 0.9.8 installed? | 18:05 |
| alee | no -- I'm just getting it to work on my system first | 18:06 |
| alee | dave-mccowan, I'm trying this -- | 18:06 |
| alee | pkey = crypto.load_privatekey( | 18:06 |
| alee | crypto.FILETYPE_PEM, | 18:06 |
| alee | tr.to_pem(secret_store.SecretType.PRIVATE, private_key, False), | 18:06 |
| alee | passphrase) | 18:06 |
| alee | but so far, its not working .. still debugging though .. | 18:07 |
| dave-mccowan | alee confirmed that stored==retrieved for the pycrypto test case after i b64 encode and wrap the binary result | 18:11 |
| *** joesavak has quit IRC | 18:17 | |
| alee | dave-mccowan, so the load_key works? | 18:17 |
| alee | dave-mccowan, load_privatekey() | 18:17 |
| alee | dave-mccowan, can you paste the code you used? | 18:18 |
| dave-mccowan | alee, same asn.1 parsing error. before and after storing/retrieving | 18:18 |
| alee | dave-mccowan, eh ? stored = retrieved , but load succeeds before and fails after? | 18:19 |
| dave-mccowan | no, for pycrypto case, load_key fails both times. OpenSSL doesn't like the looks-kinda-like-PEM or the sorta-like-DER formats. | 18:20 |
| alee | oh, interesting .. what about non-pycrypto case? | 18:25 |
| *** joesavak has joined #openstack-barbican | 18:27 | |
| *** tkelsey has joined #openstack-barbican | 18:29 | |
| *** tkelsey has quit IRC | 18:34 | |
| dave-mccowan | alee ok, just got the openssl private key to run with stored == retrieved. to do that i had to strip the '\n's. | 18:34 |
| dave-mccowan | alee but, without the '\n's, openssl can't load_privatekey() | 18:35 |
| alee | dave-mccowan, ok - I think I'm zeroing in on the problem -- and yeah -its with the \n's. | 18:37 |
| alee | dave-mccowan, the function is_pem_payload() and get_pem_components() doesn't deal with \n correctly I think | 18:38 |
| dave-mccowan | alee, i think it's a design flaw in treating (and requiring) payload as base64, when it's really not. | 18:40 |
| alee | dave-mccowan, sorta -- we strip the headers -- whats inside is base64 | 18:41 |
| dave-mccowan | alee base64 + newlines | 18:41 |
| dave-mccowan | alee and newlines are significant to openssl | 18:42 |
| alee | dave-mccowan, right -- trying to fix the functions now | 18:42 |
| openstackgerrit | Merged openstack/barbican: Adding Secret ACL controller layer changes (Part 3) https://review.openstack.org/164335 | 18:49 |
| *** chadlung has quit IRC | 19:02 | |
| *** chadlung has joined #openstack-barbican | 19:04 | |
| *** chadlung has quit IRC | 19:05 | |
| *** chadlung has joined #openstack-barbican | 19:11 | |
| *** chadlung has quit IRC | 19:16 | |
| alee | dave-mccowan, so - I think the problem may be partly in the base64 encoding and decoding. | 19:21 |
| alee | dave-mccowan, what I see is that when we base64 encode and then decode, the newlines disappear | 19:21 |
| *** joesavak has quit IRC | 19:22 | |
| alee | (decode and then encode) | 19:22 |
| alee | woodster_, reaperhulk - seen this before? | 19:23 |
| alee | woodster_, reaperhulk - so in storing and retrieving secrets, we do some base64 encoding and decoding. It looks like when we do this newlines are removed. | 19:24 |
| reaperhulk | with the base64 module or what? | 19:25 |
| alee | yup | 19:25 |
| reaperhulk | yeah that isn't surprising | 19:25 |
| reaperhulk | that module ignores them on input and doesn't put any in output | 19:25 |
| alee | is there an alternative module we can use instead? | 19:25 |
| reaperhulk | there may be a flag to have it preserve, but what's the scenario where you need it preserved? | 19:26 |
| alee | reaperhulk, well openssl seems to care about newlines. | 19:26 |
| alee | when doing load_privatekey() for instance | 19:26 |
| alee | reaperhulk, this is the problem we discussed yesterday | 19:27 |
| dave-mccowan | alee, reaperhulk i think root is secret store wants base64-only. and PEM format is not base64-only. so, how to store a private key? | 19:28 |
| alee | dave-mccowan, thats not a problem | 19:28 |
| alee | dave-mccowan, what happens is on storage we store the PEM as is - with headers | 19:29 |
| alee | its when we return that interesting stuff happens | 19:29 |
| alee | dave-mccowan, because we specify that the content-type is base64 encoded to begin with, no transformations are done when the secret is stored. | 19:30 |
| alee | the only thing we do is validate that the content sans pem headers is valid base 64 | 19:31 |
| *** joesavak has joined #openstack-barbican | 19:31 | |
| alee | but when we return the secret - we always return binary | 19:31 |
| alee | and we do this by calling base64.decode() | 19:32 |
| *** igueths has joined #openstack-barbican | 19:32 | |
| alee | reaperhulk, dave-mccowan - not sure if the newlines are removed when we do the decode() or when we re-encode later. | 19:34 |
| dave-mccowan | alee seems like using base64 on an openssl format is brute-force. can we use openssl to load_privatekey(PEM) and then dump_privatekey(ASN1)? | 19:35 |
| alee | reaperhulk, dave-mccowan - knowing all this I can work around the problem in the case I am coding (stored key case) by adding a flag to simply not do any encoding/decoding | 19:36 |
| alee | in fact thats what I'll do. | 19:36 |
| reaperhulk | it sounds like there's some issues with the way this is being normalized | 19:36 |
| reaperhulk | Work around it as necessary for now I guess but redrobot has agreed to take a closer look at what's going on here because this doesn't sound right to me | 19:36 |
| alee | but I'm worried about folks who retrieve the key and try to do things to it themselves | 19:36 |
| alee | ie. call load_privatekey() | 19:37 |
| *** kebray has quit IRC | 19:38 | |
| redrobot | Yeah... I had originally commented on rellerreller's cr that I want to take a deeper look at the base64 payload_content_encoding behaviors. There are some inconsistecies (like the fact that we're removing the ----BEGIN WHATEVER--- delimiters before base64 decoding. | 19:38 |
| rm_work | that essentially converts it from PEM to DER doesn't it? :P | 19:39 |
| alee | redrobot, yeah we need to get rellerreller to look into this when he gets back | 19:39 |
| reaperhulk | rm_work: yeah it basically makes it base64 encoded DER with line breaks every 72 chars | 19:39 |
| reaperhulk | which is not great | 19:39 |
| rm_work | lol, whelp | 19:39 |
| reaperhulk | PEM, while it is base64, should really be treated as an opaque block | 19:39 |
| redrobot | alee I'm going to see if I can get a high priority task here to look into it, so we don't have to wait until rellerreller comes back | 19:39 |
| redrobot | reaperhulk agreed | 19:39 |
| alee | redrobot, ok good. In the meantime I'll work around it for the stored-key-case | 19:40 |
| *** crc32 has joined #openstack-barbican | 19:43 | |
| *** jorge_munoz has joined #openstack-barbican | 20:03 | |
| alee | dave-mccowan, I found a couple of bugs in the way things are converted to der -- that might resolve your test case. | 20:08 |
| alee | dave-mccowan, we can try out your test case when I upload my latest CR | 20:08 |
| alee | (likely later today) | 20:09 |
| dave-mccowan | alee great! and fix all the stored key test cases too, i hope! :-) | 20:10 |
| alee | dave-mccowan, thats the hope .. | 20:11 |
| *** kebray has joined #openstack-barbican | 20:19 | |
| *** chadlung has joined #openstack-barbican | 20:23 | |
| *** kebray has quit IRC | 20:24 | |
| *** kebray has joined #openstack-barbican | 20:27 | |
| *** kebray has quit IRC | 20:36 | |
| *** kebray has joined #openstack-barbican | 20:42 | |
| *** kebray has quit IRC | 20:42 | |
| *** kebray has joined #openstack-barbican | 20:49 | |
| *** atiwari1 has joined #openstack-barbican | 20:55 | |
| *** atiwari2 has quit IRC | 20:57 | |
| *** xaeth is now known as xaeth_afk | 21:08 | |
| *** joesavak has quit IRC | 21:10 | |
| *** atiwari2 has joined #openstack-barbican | 21:10 | |
| *** atiwari1 has quit IRC | 21:13 | |
| *** alee has quit IRC | 21:19 | |
| *** chellygel has quit IRC | 21:34 | |
| *** dimtruck has quit IRC | 21:34 | |
| *** lisaclark_ has quit IRC | 21:35 | |
| *** everjeje has quit IRC | 21:35 | |
| *** dougwig has quit IRC | 21:35 | |
| *** hockeynut has quit IRC | 21:35 | |
| *** jillysciarilly has quit IRC | 21:35 | |
| *** morganfainberg has quit IRC | 21:37 | |
| *** rm_work has quit IRC | 21:37 | |
| *** morganfainberg has joined #openstack-barbican | 21:37 | |
| *** tdink has quit IRC | 21:38 | |
| *** erw has quit IRC | 21:38 | |
| *** lbragstad has quit IRC | 21:38 | |
| *** chellygel has joined #openstack-barbican | 21:38 | |
| *** jvrbanac has quit IRC | 21:38 | |
| *** Sheena_ has quit IRC | 21:38 | |
| *** tdink has joined #openstack-barbican | 21:39 | |
| *** lbragstad has joined #openstack-barbican | 21:39 | |
| *** hockeynut has joined #openstack-barbican | 21:39 | |
| *** jillysciarilly has joined #openstack-barbican | 21:40 | |
| *** zz_dimtruck has joined #openstack-barbican | 21:40 | |
| *** jvrbanac has joined #openstack-barbican | 21:40 | |
| *** Sheena_ has joined #openstack-barbican | 21:40 | |
| *** atiwari1 has joined #openstack-barbican | 21:40 | |
| *** zz_dimtruck is now known as dimtruck | 21:40 | |
| *** rm_work has joined #openstack-barbican | 21:41 | |
| *** rm_work has quit IRC | 21:41 | |
| *** rm_work has joined #openstack-barbican | 21:41 | |
| *** atiwari2 has quit IRC | 21:42 | |
| *** atiwari2 has joined #openstack-barbican | 21:43 | |
| *** dougwig has joined #openstack-barbican | 21:45 | |
| *** erw has joined #openstack-barbican | 21:45 | |
| *** atiwari1 has quit IRC | 21:46 | |
| *** lisaclark_ has joined #openstack-barbican | 21:47 | |
| *** everjeje has joined #openstack-barbican | 21:47 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Implement validators and tests for stored key certificate orders https://review.openstack.org/167291 | 22:08 |
| *** igueths has quit IRC | 22:11 | |
| *** crc32 has quit IRC | 22:20 | |
| *** chadlung has quit IRC | 22:29 | |
| *** chadlung has joined #openstack-barbican | 22:33 | |
| *** chadlung has quit IRC | 22:38 | |
| *** paul_glass has quit IRC | 22:46 | |
| woodster_ | dave-mccowan: I'm curious are you and alee trying to use the new secrets types with your certificate logic? | 22:53 |
| dave-mccowan | woodster_ we're using the private_key type inside a container for a stored-key certificate request. | 22:54 |
| dave-mccowan | woodster_ does that answer your question? i haven't been around long enough to know what is "new" :-) | 22:55 |
| *** everjeje has quit IRC | 22:56 | |
| *** kebray has quit IRC | 23:13 | |
| *** chadlung has joined #openstack-barbican | 23:35 | |
| *** chadlung has quit IRC | 23:39 | |
| *** arunkant_ has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!