Bug 1758374: fix haproxy reload crash when processing ECDSA keys #45
Conversation
With extended validation enabled, if the router detects an ECDSA private key when processing TLS data,
the sanitized key output is rendered with PEM block headers like:
-----BEGIN ECDSA PARAMETERS-----
-----END ECDSA PARAMETERS-----
However, OpenSSL recognizes the following headers for ECDSA keys[1]:
-----BEGIN EC PARAMETERS-----
-----END EC PARAMETERS-----
Consequently, when the router provides haproxy with such PEM files through
`crt-list` option, haproxy (which uses OpenSSL) fails to load the key and reload
fails.
The impact is that a Route resource containing an ECDSA key in `.spec.tls.key`
will cause haproxy reloads to crash loop, preventing any further router
processing until the problematic Route is deleted.
This patch ensures that sanitized ECDSA key output follows the OpenSSL
conventions which indirectly apply to haproxy.
[1] https://github.com/openssl/openssl/blob/master/include/openssl/pem.h#L54
|
@ironcladlou: This pull request references Bugzilla bug 1758374, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
bugzilla/invalid-bug
ironcladlou
changed the title
openshift-ci-robot
added
the
size/L
openshift-ci-robot
added
the
approved
|
/bugzilla refresh |
openshift-ci-robot
added
bugzilla/valid-bug
|
@ironcladlou: This pull request references Bugzilla bug 1758374, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/lgtm |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ironcladlou, knobunc, Miciah The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/bugzilla refresh |
openshift-ci-robot
added
bugzilla/invalid-bug
|
@eparis: This pull request references Bugzilla bug 1758374, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/bugzilla refresh |
openshift-ci-robot
added
bugzilla/valid-bug
|
@ironcladlou: This pull request references Bugzilla bug 1758374, which is valid. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
crawford
added
the
cherry-pick-approved
|
/retitle Bug 1758374: fix haproxy reload crash when processing ECDSA keys |
openshift-ci-robot
changed the title
|
@ironcladlou: All pull requests linked via external trackers have merged. Bugzilla bug 1758374 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
With extended validation enabled, if the router detects an ECDSA private key when processing TLS data,
the sanitized key output is rendered with PEM block headers like:
However, OpenSSL recognizes the following headers for ECDSA keys[1]:
Consequently, when the router provides haproxy with such PEM files through
crt-listoption, haproxy (which uses OpenSSL) fails to load the key and reloadfails.
The impact is that a Route resource containing an ECDSA key in
.spec.tls.keywill cause haproxy reloads to crash loop, preventing any further router
processing until the problematic Route is deleted.
This patch ensures that sanitized ECDSA key output follows the OpenSSL
conventions which indirectly apply to haproxy.
[1] https://github.com/openssl/openssl/blob/master/include/openssl/pem.h#L54