Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1136434 - rhevm-image-uploader ignores insecure option
Summary: rhevm-image-uploader ignores insecure option
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Virtualization Manager
Classification: Red Hat
Component: ovirt-image-uploader
Version: 3.4.0
Hardware: Unspecified
OS: Unspecified
urgent
medium
Target Milestone: ---
: 3.5.0
Assignee: Simone Tiraboschi
QA Contact: Pavel Stehlik
URL:
Whiteboard: integration
Depends On:
Blocks: 1138558 rhev3.5beta 1156165
TreeView+ depends on / blocked
 
Reported: 2014-09-02 14:39 UTC by akotov
Modified: 2015-07-13 04:13 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Previously, the rhevm-image-uploader tool would ignore the --insecure option, causing image upload operations to fail and display an unnecessary trace. With this update, the --insecure option now functions correctly.
Clone Of:
: 1138558 (view as bug list)
Environment:
Last Closed: 2015-02-11 17:46:54 UTC
oVirt Team: ---
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:0192 normal SHIPPED_LIVE rhevm-image-uploader bug fix and enhancement update 2015-02-11 22:35:56 UTC
oVirt gerrit 32329 master MERGED ovirt-image-uploader: fixing usage of API SDK insecure parameter Never
oVirt gerrit 32353 ovirt-image-uploader-3.5 MERGED ovirt-image-uploader: fixing usage of API SDK insecure parameter Never
oVirt gerrit 32355 ovirt-image-uploader-3.4 MERGED ovirt-image-uploader: fixing usage of API SDK insecure parameter Never

Description akotov 2014-09-02 14:39:08 UTC
Description of problem:

rhevm-image-uploader ignores insecure option and shows unnecessary trace

Version-Release number of selected component (if applicable):

rhevm-image-uploader-3.4.1-1.el6ev.noarch

How reproducible:


Steps to Reproduce:
1. configure user/pw/engine URL in /etc/ovirt-engine/imageuploader.conf
2. run engine-image-uploader -e export -N manageiq upload cfme-rhevm-5.3-15.x86_64.rhevm.ova -v --insecure

Actual results:

[root@dell-pe1650-02 ~]#  engine-image-uploader -e export -N manageiq upload cfme-rhevm-5.3-15.x86_64.rhevm.ova -v --insecure
ERROR: Problem connecting to the REST API.  Is the service available and does the CA certificate exist?
ERROR: 'NoneType' object is not iterable
INFO: Use the -h option to see usage.
DEBUG: Configuration:
DEBUG: command: upload
DEBUG: Traceback (most recent call last):
DEBUG:   File "/usr/bin/engine-image-uploader", line 1597, in <module>
DEBUG:     imageup = ImageUploader(conf)
DEBUG:   File "/usr/bin/engine-image-uploader", line 402, in __init__
DEBUG:     self.upload_to_storage_domain()
DEBUG:   File "/usr/bin/engine-image-uploader", line 1316, in upload_to_storage_domain
DEBUG:     (id, address, path) = self.get_host_and_path_from_export_domain(self.configuration.get('export_domain'))
DEBUG: TypeError: 'NoneType' object is not iterable



Expected results:

- insecure option is honored
- descriptive error is shown when CA file missing instead of " 'NoneType' object is not iterable"


Additional info:

upstream ovirt-engine-uploader fails too

Comment 1 Sandro Bonazzola 2014-09-02 14:53:13 UTC
Simone, can you check what's going on?
This bug is supposed to be fixed as per bug #1104500 on rhevm-image-uploader-3.4.1-1.el6ev

Comment 2 Simone Tiraboschi 2014-09-02 17:39:48 UTC
It's a bit tricky indeed and not so easy to found.
Python SDK insecure parameter simply skips hostname validation from API cert; if, at the same, we also pass a CA cert it still tries to validate that cert against that CA (independently from the hostname).

By default image-uploader is trying to read the CA file 
from /etc/pki/ovirt-engine/ca.pem
so, if your are running image-uploader from another engine host, it founds another CA cert witch make API cert verification failing.

I'm not sure if it's better to fix it here or on python SDK side.

Comment 3 akotov 2014-09-03 06:58:11 UTC
It also fails if ca.pem is missing completely, not just if CA does not match the host

Comment 6 Petr Beňas 2014-09-11 15:05:38 UTC
in rhevm-image-uploader-3.5.0-0.3.beta.el6ev.noarch

Comment 9 errata-xmlrpc 2015-02-11 17:46:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0192.html


Note You need to log in before you can comment on or make changes to this bug.