Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

server: use ecdsa instead of ed25519 when generate public/private keys #8719

Merged
merged 1 commit into from
Mar 3, 2024
Merged

server: use ecdsa instead of ed25519 when generate public/private keys #8719

merged 1 commit into from
Mar 3, 2024

Conversation

weizhouapache
Copy link
Member

@weizhouapache weizhouapache commented Feb 28, 2024 •
edited

Description

This PR replaces ed25519 with ecdsa.

PR #8549 replaced RSA with ed25519. Unfornately, ed25519 keys is unsupported in FIPS mode

$  ssh-keygen -t ed25519 -m PEM -N '' -f key1
ED25519 keys are not allowed in FIPS mode

$  ssh-keygen -t ecdsa -m PEM -N '' -f key1
Generating public/private ecdsa key pair.
Your identification has been saved in key1
Your public key has been saved in key1.pub
The key fingerprint is:
.........

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)
  • build/CI

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

  • Major
  • Minor

Bug Severity

  • BLOCKER
  • Critical
  • Major
  • Minor
  • Trivial

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

@weizhouapache
server: use ecdsa instead of ed25519 when generate public/private keys
a1a2947 
PR apache#8549 replaced RSA with ed25519. unfornately, ed25519 is unsupported in FIPS mode

```
$  ssh-keygen -t ed25519 -m PEM -N '' -f key1
ED25519 keys are not allowed in FIPS mode

$  ssh-keygen -t ecdsa -m PEM -N '' -f key1
Generating public/private ecdsa key pair.
Your identification has been saved in key1
Your public key has been saved in key1.pub
The key fingerprint is:
.........

```
@weizhouapache weizhouapache added this to the 4.18.2.0 milestone Feb 28, 2024
@weizhouapache
Copy link
Member Author

@blueorangutan package

DaanHoogland
DaanHoogland approved these changes Feb 28, 2024
View reviewed changes
Copy link
Contributor

@DaanHoogland DaanHoogland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clgtm

@DaanHoogland
Copy link
Contributor

@blueorangutan package

@blueorangutan
Copy link

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

@codecov Codecov
Copy link

codecov bot commented Feb 28, 2024 •
edited

Codecov Report

Attention: Patch coverage is 0% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 13.16%. Comparing base (4e34e6b) to head (a1a2947).
Report is 2 commits behind head on 4.18.

Files Patch % Lines
...java/com/cloud/server/ConfigurationServerImpl.java 0.00% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff            @@
##               4.18    #8719   +/-   ##
=========================================
  Coverage     13.16%   13.16%           
  Complexity     9203     9203           
=========================================
  Files          2724     2724           
  Lines        258130   258130           
  Branches      40232    40232           
=========================================
  Hits          33989    33989           
  Misses       219833   219833           
  Partials       4308     4308

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@blueorangutan
Copy link

Packaging result [SF]: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 8807

@DaanHoogland
Copy link
Contributor

@blueorangutan test alma9 kvm-alma9

@blueorangutan
Copy link

@DaanHoogland a [SL] Trillian-Jenkins test job (alma9 mgmt + kvm-alma9) has been kicked to run smoke tests

sureshanaparti
sureshanaparti approved these changes Feb 28, 2024
View reviewed changes
Copy link
Contributor

@sureshanaparti sureshanaparti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CLGTM

@DaanHoogland DaanHoogland added the Severity:Critical Critical bug label Feb 28, 2024
vishesh92
vishesh92 reviewed Feb 28, 2024
View reviewed changes
Copy link
Member

@vishesh92 vishesh92 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clgtm

JoaoJandre
JoaoJandre approved these changes Feb 28, 2024
View reviewed changes
Copy link
Contributor

@JoaoJandre JoaoJandre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CLGTM, didn't test it

@blueorangutan
Copy link

[SF] Trillian test result (tid-9339)
Environment: kvm-alma9 (x2), Advanced Networking with Mgmt server a9
Total time taken: 43892 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8719-t9339-kvm-alma9.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@weizhouapache
Copy link
Member Author

@blueorangutan test matrix

@blueorangutan
Copy link

@weizhouapache a [SL] Trillian-Jenkins matrix job (centos7 mgmt + xenserver71, rocky8 mgmt + vmware67u3, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests

@blueorangutan
Copy link

[SF] Trillian Build Failed (tid-9367)

@blueorangutan
Copy link

[SF] Trillian test result (tid-9366)
Environment: xenserver-71 (x2), Advanced Networking with Mgmt server 7
Total time taken: 38643 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8719-t9366-xenserver-71.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@blueorangutan
Copy link

[SF] Trillian test result (tid-9368)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 40688 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8719-t9368-kvm-centos7.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@blueorangutan
Copy link

[SF] Trillian test result (tid-9369)
Environment: vmware-67u3 (x2), Advanced Networking with Mgmt server u22
Total time taken: 51056 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8719-t9369-vmware-67u3.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@weizhouapache weizhouapache merged commit 10f72a1 into apache:4.18 Mar 3, 2024
25 of 26 checks passed
@DaanHoogland DaanHoogland deleted the 4.18-create-ecdsa-key branch March 4, 2024 08:25
dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Mar 5, 2024
@weizhouapache @dhslove
server: use ecdsa instead of ed25519 when generate public/private keys (
f3f266c 
apache#8719)

PR apache#8549 replaced RSA with ed25519. unfornately, ed25519 is unsupported in FIPS mode

```
$  ssh-keygen -t ed25519 -m PEM -N '' -f key1
ED25519 keys are not allowed in FIPS mode

$  ssh-keygen -t ecdsa -m PEM -N '' -f key1
Generating public/private ecdsa key pair.
Your identification has been saved in key1
Your public key has been saved in key1.pub
The key fingerprint is:
.........

```
@rwdj rwdj mentioned this pull request Apr 14, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vishesh92 vishesh92 vishesh92 left review comments

@rohityadavcloud rohityadavcloud rohityadavcloud approved these changes

@DaanHoogland DaanHoogland DaanHoogland approved these changes

@sureshanaparti sureshanaparti sureshanaparti approved these changes

@JoaoJandre JoaoJandre JoaoJandre approved these changes

Assignees
No one assigned
Labels
component:management-server Severity:Critical Critical bug
Projects
None yet
Milestone
4.18.2.0
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@weizhouapache @DaanHoogland @blueorangutan @rohityadavcloud @vishesh92 @sureshanaparti @JoaoJandre