From: Aliasgar Ginwala <[email protected]> Setting up OVN on new kernel bumps openssl version. Since OVS PKI infrastructure that generated older ssl certs based on old openssl version, raft fails with error
2024-02-27T19:28:39.673Z|00022|stream_ssl|WARN|SSL_connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed For running ovn-controller in container, we can still pin ssl-ciphers directly. This was missed to set via ovn-ctl utility and hence setting the same. e.g. pin ciphers to 'HIGH:!aNULL:!MD5:@SECLEVEL=1' for raft/ovn-controllers, etc. Also update options to show up ssl-ciphers and ssl-protocols for each components in help. Signed-off-by: Aliasgar Ginwala <[email protected]> --- utilities/ovn-ctl | 69 +++++++++++++++++++++++++++++++++++++++-- utilities/ovn-ctl.8.xml | 16 ++++++++++ 2 files changed, 83 insertions(+), 2 deletions(-) diff --git a/utilities/ovn-ctl b/utilities/ovn-ctl index 50d588358..700efe35a 100755 --- a/utilities/ovn-ctl +++ b/utilities/ovn-ctl @@ -185,6 +185,8 @@ start_ovsdb__() { local ovn_db_election_timer local relay_mode local cluster_db_upgrade + local ovn_db_ssl_protocols + local ovn_db_ssl_ciphers eval db_pid_file=\$DB_${DB}_PIDFILE eval cluster_local_addr=\$DB_${DB}_CLUSTER_LOCAL_ADDR eval cluster_local_port=\$DB_${DB}_CLUSTER_LOCAL_PORT @@ -214,6 +216,8 @@ start_ovsdb__() { eval relay_mode=\$RELAY_MODE eval relay_remote=\$DB_${DB}_REMOTE eval cluster_db_upgrade=\$DB_CLUSTER_SCHEMA_UPGRADE + eval ovn_db_ssl_protocols=\$OVN_${DB}_DB_SSL_PROTOCOLS + eval ovn_db_ssl_ciphers=\$OVN_${DB}_DB_SSL_CIPHERS ovn_install_dir "$OVN_RUNDIR" ovn_install_dir "$ovn_logdir" @@ -313,8 +317,17 @@ $cluster_remote_port set "$@" --ca-cert=db:$schema_name,SSL,ca_cert fi - set "$@" --ssl-protocols=db:$schema_name,SSL,ssl_protocols - set "$@" --ssl-ciphers=db:$schema_name,SSL,ssl_ciphers + if test X"$ovn_db_ssl_protocols" != X; then + set "$@" --ssl-protocols=$ovn_db_ssl_protocols + else + set "$@" --ssl-protocols=db:$schema_name,SSL,ssl_protocols + fi + + if test X"$ovn_db_ssl_ciphers" != X; then + set "$@" --ssl-ciphers=$ovn_db_ssl_ciphers + else + set "$@" --ssl-ciphers=db:$schema_name,SSL,ssl_ciphers + fi if test X"$create_insecure_remote" = Xyes; then set "$@" --remote=ptcp:$port:$addr @@ -523,6 +536,12 @@ start_northd () { if test "$OVN_NORTHD_N_THREADS" != 1; then set "$@" --n-threads=$OVN_NORTHD_N_THREADS fi + if test X"$OVN_NORTHD_SSL_PROTOCOLS" != X; then + set "$@" --ssl-protocols=$OVN_NORTHD_SSL_PROTOCOLS + fi + if test X"$OVN_NORTHD_SSL_CIPHERS" != X; then + set "$@" --ssl-ciphers=$OVN_NORTHD_SSL_CIPHERS + fi [ "$OVN_USER" != "" ] && set "$@" --user "$OVN_USER" @@ -558,6 +577,12 @@ start_ic () { if test X"$OVN_IC_SSL_CA_CERT" != X; then set "$@" --ca-cert=$OVN_IC_SSL_CA_CERT fi + if test X"$OVN_IC_SSL_PROTOCOLS" != X; then + set "$@" --ssl-protocols=$OVN_IC_SSL_PROTOCOLS + fi + if test X"$OVN_IC_SSL_CIPHERS" != X; then + set "$@" --ssl-ciphers=$OVN_IC_SSL_CIPHERS + fi [ "$OVN_USER" != "" ] && set "$@" --user "$OVN_USER" @@ -586,6 +611,12 @@ start_controller () { if test X"$OVN_CONTROLLER_SSL_BOOTSTRAP_CA_CERT" != X; then set "$@" --bootstrap-ca-cert=$OVN_CONTROLLER_SSL_BOOTSTRAP_CA_CERT fi + if test X"$OVN_CONTROLLER_SSL_PROTOCOLS" != X; then + set "$@" --ssl-protocols=$OVN_CONTROLLER_SSL_PROTOCOLS + fi + if test X"$OVN_CONTROLLER_SSL_CIPHERS" != X; then + set "$@" --ssl-ciphers=$OVN_CONTROLLER_SSL_CIPHERS + fi [ "$OVN_USER" != "" ] && set "$@" --user "$OVN_USER" @@ -611,6 +642,12 @@ start_controller_vtep () { if test X"$OVN_CONTROLLER_SSL_BOOTSTRAP_CA_CERT" != X; then set "$@" --bootstrap-ca-cert=$OVN_CONTROLLER_SSL_BOOTSTRAP_CA_CERT fi + if test X"$OVN_CONTROLLER_SSL_PROTOCOLS" != X; then + set "$@" --ssl-protocols=$OVN_CONTROLLER_SSL_PROTOCOLS + fi + if test X"$OVN_CONTROLLER_SSL_CIPHERS" != X; then + set "$@" --ssl-ciphers=$OVN_CONTROLLER_SSL_CIPHERS + fi if test X"$DB_SOCK" != X; then set "$@" --vtep-db=$DB_SOCK fi @@ -814,14 +851,20 @@ set_defaults () { OVN_CONTROLLER_SSL_CERT="" OVN_CONTROLLER_SSL_CA_CERT="" OVN_CONTROLLER_SSL_BOOTSTRAP_CA_CERT="" + OVN_CONTROLLER_SSL_PROTOCOLS="" + OVN_CONTROLLER_SSL_CIPHERS="" OVN_NORTHD_SSL_KEY="" OVN_NORTHD_SSL_CERT="" OVN_NORTHD_SSL_CA_CERT="" + OVN_NORTHD_SSL_PROTOCOLS="" + OVN_NORTHD_SSL_CIPHERS="" OVN_IC_SSL_KEY="" OVN_IC_SSL_CERT="" OVN_IC_SSL_CA_CERT="" + OVN_IC_SSL_PROTOCOLS="" + OVN_IC_SSL_CIPHERS="" DB_SB_CREATE_INSECURE_REMOTE="no" DB_NB_CREATE_INSECURE_REMOTE="no" @@ -878,18 +921,26 @@ set_defaults () { OVN_NB_DB_SSL_KEY="" OVN_NB_DB_SSL_CERT="" OVN_NB_DB_SSL_CA_CERT="" + OVN_NB_DB_SSL_PROTOCOLS="" + OVN_NB_DB_SSL_CIPHERS="" OVN_SB_DB_SSL_KEY="" OVN_SB_DB_SSL_CERT="" OVN_SB_DB_SSL_CA_CERT="" + OVN_SB_DB_SSL_PROTOCOLS="" + OVN_SB_DB_SSL_CIPHERS="" OVN_IC_NB_DB_SSL_KEY="" OVN_IC_NB_DB_SSL_CERT="" OVN_IC_NB_DB_SSL_CA_CERT="" + OVN_IC_NB_DB_SSL_PROTOCOLS="" + OVN_IC_NB_DB_SSL_CIPHERS="" OVN_IC_SB_DB_SSL_KEY="" OVN_IC_SB_DB_SSL_CERT="" OVN_IC_SB_DB_SSL_CA_CERT="" + OVN_IC_SB_DB_SSL_PROTOCOLS="" + OVN_IC_SB_DB_SSL_CIPHERS="" RELAY_MODE=no DB_SB_RELAY_REMOTE= @@ -988,15 +1039,23 @@ Options: --ovn-controller-ssl-cert=CERT OVN Southbound SSL certificate file --ovn-controller-ssl-ca-cert=CERT OVN Southbound SSL CA certificate file --ovn-controller-ssl-bootstrap-ca-cert=CERT Bootstrapped OVN Southbound SSL CA certificate file + --ovn-controller-ssl-protocols=PROTOCOLS OVN Southbound SSL protocols + --ovn-controller-ssl-ciphers=CIPHERS OVN Southbound SSL cipher list --ovn-nb-db-ssl-key=KEY OVN Northbound DB SSL private key file --ovn-nb-db-ssl-cert=CERT OVN Northbound DB SSL certificate file --ovn-nb-db-ssl-ca-cert=CERT OVN Northbound DB SSL CA certificate file + --ovn-nb-db-ssl-protocols=PROTOCOLS OVN Northbound DB SSL protocols + --ovn-nb-db-ssl-ciphers=CIPHERS OVN Northbound DB SSL cipher list --ovn-sb-db-ssl-key=KEY OVN Southbound DB SSL private key file --ovn-sb-db-ssl-cert=CERT OVN Southbound DB SSL certificate file --ovn-sb-db-ssl-ca-cert=CERT OVN Southbound DB SSL CA certificate file + --ovn-sb-db-ssl-protocols=PROTOCOLS OVN Southbound DB SSL protocols + --ovn-sb-db-ssl-ciphers=CIPHERS OVN Southbound DB SSL cipher list --ovn-northd-ssl-key=KEY OVN Northd SSL private key file --ovn-northd-ssl-cert=CERT OVN Northd SSL certificate file --ovn-northd-ssl-ca-cert=CERT OVN Northd SSL CA certificate file + --ovn-northd-ssl-protocols=PROTOCOLS OVN Northd SSL protocols + --ovn-northd-ssl-ciphers=CIPHERS OVN Northd SSL cipher list --ovn-manage-ovsdb=yes|no Whether or not the OVN NB/SB databases should be automatically started and stopped along with ovn-northd. The default is "yes". If @@ -1014,14 +1073,20 @@ Options: --ovn-ic-ssl-key=KEY OVN IC SSL private key file --ovn-ic-ssl-cert=CERT OVN IC SSL certificate file --ovn-ic-ssl-ca-cert=CERT OVN IC SSL CA certificate file + --ovn-ic-ssl-protocols=PROTOCOLS OVN IC SSL protocols + --ovn-ic-ssl-ciphers=CIPHERS OVN IC SSL cipher list --ovn-ic-log=STRING ovn-ic process logging params (default: $OVN_IC_LOG) --ovn-ic-logfile=STRING ovn-ic process log file (default: $OVN_IC_LOGFILE) --ovn-ic-nb-db-ssl-key=KEY OVN IC Northbound DB SSL private key file --ovn-ic-nb-db-ssl-cert=CERT OVN IC Northbound DB SSL certificate file --ovn-ic-nb-db-ssl-ca-cert=CERT OVN IC Northbound DB SSL CA certificate file + --ovn-ic-nb-db-ssl-protocols=PROTOCOLS OVN IC Northbound DB SSL protocols + --ovn-ic-nb-db-ssl-ciphers=CIPHERS OVN IC Northbound DB SSL cipher list --ovn-ic-sb-db-ssl-key=KEY OVN IC Southbound DB SSL private key file --ovn-ic-sb-db-ssl-cert=CERT OVN IC Southbound DB SSL certificate file --ovn-ic-sb-db-ssl-ca-cert=CERT OVN IC Southbound DB SSL CA certificate file + --ovn-ic-sb-db-ssl-protocols=PROTOCOLS OVN IC Southbound DB SSL protocols + --ovn-ic-sb-db-ssl-ciphers=CIPHERS OVN IC Southbound DB SSL cipher list --ovn-user="user[:group]" pass the --user flag to the ovn daemons --ovs-user="user[:group]" pass the --user flag to ovs daemons --ovsdb-nb-wrapper=WRAPPER run with a wrapper like valgrind for debugging diff --git a/utilities/ovn-ctl.8.xml b/utilities/ovn-ctl.8.xml index 3bab055e4..57712bfdc 100644 --- a/utilities/ovn-ctl.8.xml +++ b/utilities/ovn-ctl.8.xml @@ -92,6 +92,22 @@ <p><code>--ovn-controller-ssl-ca-cert=<var>CERT</var></code></p> <p><code>--ovn-controller-ssl-bootstrap-ca-cert=<var>CERT</var></code></p> + <h1>Protocol and Cipher options</h1> + <p><code>--ovn-controller-ssl-protocols=<var>PROTOCOLS</var></code></p> + <p><code>--ovn-ic-ssl-protocols=<var>PROTOCOLS</var></code></p> + <p><code>--ovn-northd-ssl-protocols=<var>PROTOCOLS</var></code></p> + <p><code>--ovn-nb-db-ssl-protocols=<var>PROTOCOLS</var></code></p> + <p><code>--ovn-sb-db-ssl-protocols=<var>PROTOCOLS</var></code></p> + <p><code>--ovn-ic-nb-db-ssl-protocols=<var>PROTOCOLS</var></code></p> + <p><code>--ovn-ic-sb-db-ssl-protocols=<var>PROTOCOLS</var></code></p> + <p><code>--ovn-controller-ssl-ciphers=<var>CIPHERS</var></code></p> + <p><code>--ovn-ic-ssl-ciphers=<var>CIPHERS</var></code></p> + <p><code>--ovn-northd-ssl-ciphers=<var>CIPHERS</var></code></p> + <p><code>--ovn-nb-db-ssl-ciphers=<var>CIPHERS</var></code></p> + <p><code>--ovn-sb-db-ssl-ciphers=<var>CIPHERS</var></code></p> + <p><code>--ovn-ic-nb-db-ssl-ciphers=<var>CIPHERS</var></code></p> + <p><code>--ovn-ic-sb-db-ssl-ciphers=<var>CIPHERS</var></code></p> + <h1>Address and port options</h1> <p><code>--db-nb-sync-from-addr=<var>IP ADDRESS</var></code></p> <p><code>--db-nb-sync-from-port=<var>PORT NUMBER</var></code></p> -- 2.39.3 (Apple Git-145) _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
