** Description changed: [ Impact ] - Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default - the DSA key, disallowed in FIPS. This makes regression testing fail. + * Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default the DSA key, disallowed in FIPS. This makes regression testing fail. + The test exercise the command "uvt-kvm create bjf-test release=<release> arch=<arch>" that uses the uvtool ssh.py script, running into a failure + + =========================== + + sudo uvt-simplestreams-libvirt sync --source http://cloud-images.ubuntu.com/daily release=focal arch=amd64 + + sudo uvt-kvm create bjf-test release=focal arch=amd64 --ssh-public-key /home/ubuntu/.ssh/id_rsa.pub + sshkey_generate failed + Traceback (most recent call last): + File "/usr/bin/uvt-kvm", line 35, in <module> + uvtool.libvirt.kvm.main_cli_wrapper(sys.argv[1:]) + File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1115, in main_cli_wrapper + main(*args, **kwargs) + File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1110, in main + args.func(parser, args) + File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 865, in main_create + ssh_host_keys, ssh_known_hosts = uvtool.ssh.generate_ssh_host_keys() + File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 50, in generate_ssh_host_keys + _keygen(key_type, private_path) + File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 28, in _keygen + subprocess.check_call([ + File "/usr/lib/python3.8/subprocess.py", line 364, in check_call + raise CalledProcessError(retcode, cmd) + subprocess.CalledProcessError: Command '['ssh-keygen', '-q', '-f', '/tmp/uvt-kvm.sshtmpuaqjmddo/dsa', '-N', '', '-t', 'dsa', '-C', 'root@localhost']' returned non-zero exit status 255. + + cleanup + =========================== [ Test Plan ] - Test on both Focal and Bionic the results of the ubuntu_kvm_smoke_test - from autotest and observe the DSA key is discarded, but the RSA or - ellyptic curve key is used for the VM key. + * On both Focal and Bionic, install a ubuntu FIPS kernel, install the autopackage test following the guide from here https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ and run + sudo autotest/client/autotest-local -v autotest/client/tests/ubuntu_kvm_smoke_test/control + The result of the test should be for both Kernels "END GOOD" + + * Ensure that on both Focal and Bionic the results of the + ubuntu_kvm_smoke_test from autotest and observe the DSA key is + discarded, but the RSA or ellyptic curve key is used for the VM. [ Fix ] - The fix consists in backporting the commit - https://git.launchpad.net/uvtool/commit/?id=0e92d8b6e6ddd766f41824a52d8af0f221f0f9fd + * The fix consists in backporting the commit + https://git.launchpad.net/uvtool/commit/?id=0e92d8b6e6ddd766f41824a52d8af0f221f0f9fd already present in newer packages. The fix has been already approved in the past in this merge request https://code.launchpad.net/~paelzer/uvtool/+git/uvtool/+merge/405796 [ Where problem could occur ] - No impact is expected, as the fix only increases the number of - algorithms to be used before failing. + * Changes are isolated to ssh.py, no impact is expected, as the fix only + increases the number of algorithms to be used before failing. [ Original report ] After enabling the fips-dev ppa and using user-space tool there. The ubuntu_kvm_smoke_test starts failing with: + uvt-kvm create bjf-test release=bionic arch=s390x DSA keys are not allowed in FIPS mode Take a closer look inside /usr/lib/python2.7/dist- packages/uvtool/libvirt/kvm.py, which calls uvtool.ssh.generate_ssh_host_keys() from /usr/lib/python2.7/dist- packages/uvtool/ssh.py From ssh.py, you will find it will try to generate 4 different key types, includes "dsa": KEY_TYPES = ['rsa', 'dsa', 'ecdsa', 'ed25519'] ... def generate_ssh_host_keys(): cloud_init_result = {} known_hosts_result = [] tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp') try: for key_type in KEY_TYPES: private_path = os.path.join(tmp_dir, key_type) _keygen(key_type, private_path)
** Description changed: [ Impact ] * Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default the DSA key, disallowed in FIPS. This makes regression testing fail. The test exercise the command "uvt-kvm create bjf-test release=<release> arch=<arch>" that uses the uvtool ssh.py script, running into a failure =========================== + sudo uvt-simplestreams-libvirt sync --source http://cloud-images.ubuntu.com/daily release=focal arch=amd64 + sudo uvt-kvm create bjf-test release=focal arch=amd64 --ssh-public-key /home/ubuntu/.ssh/id_rsa.pub sshkey_generate failed Traceback (most recent call last): - File "/usr/bin/uvt-kvm", line 35, in <module> - uvtool.libvirt.kvm.main_cli_wrapper(sys.argv[1:]) - File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1115, in main_cli_wrapper - main(*args, **kwargs) - File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1110, in main - args.func(parser, args) - File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 865, in main_create - ssh_host_keys, ssh_known_hosts = uvtool.ssh.generate_ssh_host_keys() - File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 50, in generate_ssh_host_keys - _keygen(key_type, private_path) - File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 28, in _keygen - subprocess.check_call([ - File "/usr/lib/python3.8/subprocess.py", line 364, in check_call - raise CalledProcessError(retcode, cmd) + File "/usr/bin/uvt-kvm", line 35, in <module> + uvtool.libvirt.kvm.main_cli_wrapper(sys.argv[1:]) + File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1115, in main_cli_wrapper + main(*args, **kwargs) + File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1110, in main + args.func(parser, args) + File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 865, in main_create + ssh_host_keys, ssh_known_hosts = uvtool.ssh.generate_ssh_host_keys() + File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 50, in generate_ssh_host_keys + _keygen(key_type, private_path) + File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 28, in _keygen + subprocess.check_call([ + File "/usr/lib/python3.8/subprocess.py", line 364, in check_call + raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '['ssh-keygen', '-q', '-f', '/tmp/uvt-kvm.sshtmpuaqjmddo/dsa', '-N', '', '-t', 'dsa', '-C', 'root@localhost']' returned non-zero exit status 255. + cleanup =========================== [ Test Plan ] - * On both Focal and Bionic, install a ubuntu FIPS kernel, install the autopackage test following the guide from here https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ and run - sudo autotest/client/autotest-local -v autotest/client/tests/ubuntu_kvm_smoke_test/control - The result of the test should be for both Kernels "END GOOD" + * On both Focal and Bionic + - Install a ubuntu FIPS kernel + - Install the autopackage test following the guide from here https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ + - Run sudo autotest/client/autotest-local -v autotest/client/tests/ubuntu_kvm_smoke_test/control - * Ensure that on both Focal and Bionic the results of the + The result of the test should be for both Kernels "END GOOD", ensuring + that on both Focal and Bionic FIPS the results of the ubuntu_kvm_smoke_test from autotest and observe the DSA key is discarded, but the RSA or ellyptic curve key is used for the VM. [ Fix ] * The fix consists in backporting the commit https://git.launchpad.net/uvtool/commit/?id=0e92d8b6e6ddd766f41824a52d8af0f221f0f9fd already present in newer packages. The fix has been already approved in the past in this merge request https://code.launchpad.net/~paelzer/uvtool/+git/uvtool/+merge/405796 [ Where problem could occur ] * Changes are isolated to ssh.py, no impact is expected, as the fix only increases the number of algorithms to be used before failing. [ Original report ] After enabling the fips-dev ppa and using user-space tool there. The ubuntu_kvm_smoke_test starts failing with: + uvt-kvm create bjf-test release=bionic arch=s390x DSA keys are not allowed in FIPS mode Take a closer look inside /usr/lib/python2.7/dist- packages/uvtool/libvirt/kvm.py, which calls uvtool.ssh.generate_ssh_host_keys() from /usr/lib/python2.7/dist- packages/uvtool/ssh.py From ssh.py, you will find it will try to generate 4 different key types, includes "dsa": KEY_TYPES = ['rsa', 'dsa', 'ecdsa', 'ed25519'] ... def generate_ssh_host_keys(): cloud_init_result = {} known_hosts_result = [] tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp') try: for key_type in KEY_TYPES: private_path = os.path.join(tmp_dir, key_type) _keygen(key_type, private_path) ** Description changed: [ Impact ] * Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default the DSA key, disallowed in FIPS. This makes regression testing fail. The test exercise the command "uvt-kvm create bjf-test release=<release> arch=<arch>" that uses the uvtool ssh.py script, running into a failure =========================== + sudo uvt-simplestreams-libvirt sync --source http://cloud-images.ubuntu.com/daily release=focal arch=amd64 + sudo uvt-kvm create bjf-test release=focal arch=amd64 --ssh-public-key /home/ubuntu/.ssh/id_rsa.pub sshkey_generate failed Traceback (most recent call last): File "/usr/bin/uvt-kvm", line 35, in <module> uvtool.libvirt.kvm.main_cli_wrapper(sys.argv[1:]) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1115, in main_cli_wrapper main(*args, **kwargs) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1110, in main args.func(parser, args) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 865, in main_create ssh_host_keys, ssh_known_hosts = uvtool.ssh.generate_ssh_host_keys() File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 50, in generate_ssh_host_keys _keygen(key_type, private_path) File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 28, in _keygen subprocess.check_call([ File "/usr/lib/python3.8/subprocess.py", line 364, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '['ssh-keygen', '-q', '-f', '/tmp/uvt-kvm.sshtmpuaqjmddo/dsa', '-N', '', '-t', 'dsa', '-C', 'root@localhost']' returned non-zero exit status 255. + cleanup =========================== [ Test Plan ] * On both Focal and Bionic - - Install a ubuntu FIPS kernel - - Install the autopackage test following the guide from here https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ - - Run sudo autotest/client/autotest-local -v autotest/client/tests/ubuntu_kvm_smoke_test/control + - Install a ubuntu FIPS kernel + - Set the Kernel in FIPS mode by adding fips=1 to the kernel command line + - Install the autopackage test following the guide from here https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ + - Run sudo autotest/client/autotest-local -v autotest/client/tests/ubuntu_kvm_smoke_test/control The result of the test should be for both Kernels "END GOOD", ensuring that on both Focal and Bionic FIPS the results of the ubuntu_kvm_smoke_test from autotest and observe the DSA key is discarded, but the RSA or ellyptic curve key is used for the VM. [ Fix ] * The fix consists in backporting the commit https://git.launchpad.net/uvtool/commit/?id=0e92d8b6e6ddd766f41824a52d8af0f221f0f9fd already present in newer packages. The fix has been already approved in the past in this merge request https://code.launchpad.net/~paelzer/uvtool/+git/uvtool/+merge/405796 [ Where problem could occur ] * Changes are isolated to ssh.py, no impact is expected, as the fix only increases the number of algorithms to be used before failing. [ Original report ] After enabling the fips-dev ppa and using user-space tool there. The ubuntu_kvm_smoke_test starts failing with: + uvt-kvm create bjf-test release=bionic arch=s390x DSA keys are not allowed in FIPS mode Take a closer look inside /usr/lib/python2.7/dist- packages/uvtool/libvirt/kvm.py, which calls uvtool.ssh.generate_ssh_host_keys() from /usr/lib/python2.7/dist- packages/uvtool/ssh.py From ssh.py, you will find it will try to generate 4 different key types, includes "dsa": KEY_TYPES = ['rsa', 'dsa', 'ecdsa', 'ed25519'] ... def generate_ssh_host_keys(): cloud_init_result = {} known_hosts_result = [] tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp') try: for key_type in KEY_TYPES: private_path = os.path.join(tmp_dir, key_type) _keygen(key_type, private_path) ** Description changed: [ Impact ] * Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default the DSA key, disallowed in FIPS. This makes regression testing fail. The test exercise the command "uvt-kvm create bjf-test release=<release> arch=<arch>" that uses the uvtool ssh.py script, running into a failure =========================== + sudo uvt-simplestreams-libvirt sync --source http://cloud-images.ubuntu.com/daily release=focal arch=amd64 + sudo uvt-kvm create bjf-test release=focal arch=amd64 --ssh-public-key /home/ubuntu/.ssh/id_rsa.pub sshkey_generate failed Traceback (most recent call last): File "/usr/bin/uvt-kvm", line 35, in <module> uvtool.libvirt.kvm.main_cli_wrapper(sys.argv[1:]) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1115, in main_cli_wrapper main(*args, **kwargs) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1110, in main args.func(parser, args) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 865, in main_create ssh_host_keys, ssh_known_hosts = uvtool.ssh.generate_ssh_host_keys() File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 50, in generate_ssh_host_keys _keygen(key_type, private_path) File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 28, in _keygen subprocess.check_call([ File "/usr/lib/python3.8/subprocess.py", line 364, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '['ssh-keygen', '-q', '-f', '/tmp/uvt-kvm.sshtmpuaqjmddo/dsa', '-N', '', '-t', 'dsa', '-C', 'root@localhost']' returned non-zero exit status 255. + cleanup =========================== [ Test Plan ] * On both Focal and Bionic - Install a ubuntu FIPS kernel - - Set the Kernel in FIPS mode by adding fips=1 to the kernel command line - - Install the autopackage test following the guide from here https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ + - Set the Kernel in FIPS mode by adding fips=1 to the kernel command line + - Reboot the machine and check the running kernel is the expected one and + Fips mode is enabled by running "cat /proc/sys/crypto/fips_enabled" + and getting "1" as a result + - Install the autopackage test following the guide from here + https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ - Run sudo autotest/client/autotest-local -v autotest/client/tests/ubuntu_kvm_smoke_test/control The result of the test should be for both Kernels "END GOOD", ensuring that on both Focal and Bionic FIPS the results of the ubuntu_kvm_smoke_test from autotest and observe the DSA key is discarded, but the RSA or ellyptic curve key is used for the VM. [ Fix ] * The fix consists in backporting the commit https://git.launchpad.net/uvtool/commit/?id=0e92d8b6e6ddd766f41824a52d8af0f221f0f9fd already present in newer packages. The fix has been already approved in the past in this merge request https://code.launchpad.net/~paelzer/uvtool/+git/uvtool/+merge/405796 [ Where problem could occur ] * Changes are isolated to ssh.py, no impact is expected, as the fix only increases the number of algorithms to be used before failing. [ Original report ] After enabling the fips-dev ppa and using user-space tool there. The ubuntu_kvm_smoke_test starts failing with: + uvt-kvm create bjf-test release=bionic arch=s390x DSA keys are not allowed in FIPS mode Take a closer look inside /usr/lib/python2.7/dist- packages/uvtool/libvirt/kvm.py, which calls uvtool.ssh.generate_ssh_host_keys() from /usr/lib/python2.7/dist- packages/uvtool/ssh.py From ssh.py, you will find it will try to generate 4 different key types, includes "dsa": KEY_TYPES = ['rsa', 'dsa', 'ecdsa', 'ed25519'] ... def generate_ssh_host_keys(): cloud_init_result = {} known_hosts_result = [] tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp') try: for key_type in KEY_TYPES: private_path = os.path.join(tmp_dir, key_type) _keygen(key_type, private_path) ** Description changed: [ Impact ] * Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default the DSA key, disallowed in FIPS. This makes regression testing fail. The test exercise the command "uvt-kvm create bjf-test release=<release> arch=<arch>" that uses the uvtool ssh.py script, running into a failure =========================== + sudo uvt-simplestreams-libvirt sync --source http://cloud-images.ubuntu.com/daily release=focal arch=amd64 + sudo uvt-kvm create bjf-test release=focal arch=amd64 --ssh-public-key /home/ubuntu/.ssh/id_rsa.pub sshkey_generate failed Traceback (most recent call last): File "/usr/bin/uvt-kvm", line 35, in <module> uvtool.libvirt.kvm.main_cli_wrapper(sys.argv[1:]) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1115, in main_cli_wrapper main(*args, **kwargs) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1110, in main args.func(parser, args) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 865, in main_create ssh_host_keys, ssh_known_hosts = uvtool.ssh.generate_ssh_host_keys() File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 50, in generate_ssh_host_keys _keygen(key_type, private_path) File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 28, in _keygen subprocess.check_call([ File "/usr/lib/python3.8/subprocess.py", line 364, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '['ssh-keygen', '-q', '-f', '/tmp/uvt-kvm.sshtmpuaqjmddo/dsa', '-N', '', '-t', 'dsa', '-C', 'root@localhost']' returned non-zero exit status 255. + cleanup =========================== [ Test Plan ] * On both Focal and Bionic - Install a ubuntu FIPS kernel - Set the Kernel in FIPS mode by adding fips=1 to the kernel command line - - Reboot the machine and check the running kernel is the expected one and - Fips mode is enabled by running "cat /proc/sys/crypto/fips_enabled" - and getting "1" as a result + - Reboot the machine and check the running kernel is the expected one and + Fips mode is enabled by running "cat /proc/sys/crypto/fips_enabled" + and getting "1" as a result - Install the autopackage test following the guide from here - https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ + https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ - Run sudo autotest/client/autotest-local -v autotest/client/tests/ubuntu_kvm_smoke_test/control The result of the test should be for both Kernels "END GOOD", ensuring that on both Focal and Bionic FIPS the results of the ubuntu_kvm_smoke_test from autotest and observe the DSA key is - discarded, but the RSA or ellyptic curve key is used for the VM. + discarded, but the RSA or ellyptic curve key is used for the VM; no + python3 Traceback should be observed. + + As an example the result should contain something similar to the following snippets (uuid/architecture/timestamps... can change) + =========================== + ... + 08:45:19 ERROR| [stderr] + uvt-kvm create bjf-test release=focal arch=amd64 + 08:45:21 ERROR| [stderr] sshkey_generate failed + 08:45:22 ERROR| [stderr] sshkey_generate failed + 08:45:25 ERROR| [stderr] + uvt-kvm wait --timeout 720 bjf-test --insecure --ssh-private-key-file /home/ubuntu/.ssh/id_rsa + 08:46:29 ERROR| [stderr] ++ virsh -c qemu:///system domuuid bjf-test + 08:46:29 ERROR| [stderr] + uuid=6065684f-8760-4f84-8e41-2a912cd8eab4 + 08:46:29 ERROR| [stderr] ++ uvt-kvm ip bjf-test + ... + 08:46:35 INFO | END GOOD ubuntu_kvm_smoke_test.kvm_smoke_test ubuntu_kvm_smoke_test.kvm_smoke_test timestamp=1787733995 localtime=Aug 26 08:46:35 + 08:46:35 DEBUG| Persistent state client._record_indent now set to 1 + 08:46:35 DEBUG| Persistent state client.unexpected_reboot deleted + 08:46:35 INFO | END GOOD ---- ---- timestamp=1787733995 localtime=Aug 26 08:46:35 + =========================== [ Fix ] * The fix consists in backporting the commit https://git.launchpad.net/uvtool/commit/?id=0e92d8b6e6ddd766f41824a52d8af0f221f0f9fd already present in newer packages. The fix has been already approved in the past in this merge request https://code.launchpad.net/~paelzer/uvtool/+git/uvtool/+merge/405796 [ Where problem could occur ] * Changes are isolated to ssh.py, no impact is expected, as the fix only increases the number of algorithms to be used before failing. [ Original report ] After enabling the fips-dev ppa and using user-space tool there. The ubuntu_kvm_smoke_test starts failing with: + uvt-kvm create bjf-test release=bionic arch=s390x DSA keys are not allowed in FIPS mode Take a closer look inside /usr/lib/python2.7/dist- packages/uvtool/libvirt/kvm.py, which calls uvtool.ssh.generate_ssh_host_keys() from /usr/lib/python2.7/dist- packages/uvtool/ssh.py From ssh.py, you will find it will try to generate 4 different key types, includes "dsa": KEY_TYPES = ['rsa', 'dsa', 'ecdsa', 'ed25519'] ... def generate_ssh_host_keys(): cloud_init_result = {} known_hosts_result = [] tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp') try: for key_type in KEY_TYPES: private_path = os.path.join(tmp_dir, key_type) _keygen(key_type, private_path) ** Description changed: [ Impact ] * Running ubuntu_kvm_smoke_test in FIPS enabled kernels uses by default the DSA key, disallowed in FIPS. This makes regression testing fail. The test exercise the command "uvt-kvm create bjf-test release=<release> arch=<arch>" that uses the uvtool ssh.py script, running into a failure =========================== + sudo uvt-simplestreams-libvirt sync --source http://cloud-images.ubuntu.com/daily release=focal arch=amd64 + sudo uvt-kvm create bjf-test release=focal arch=amd64 --ssh-public-key /home/ubuntu/.ssh/id_rsa.pub sshkey_generate failed Traceback (most recent call last): File "/usr/bin/uvt-kvm", line 35, in <module> uvtool.libvirt.kvm.main_cli_wrapper(sys.argv[1:]) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1115, in main_cli_wrapper main(*args, **kwargs) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 1110, in main args.func(parser, args) File "/usr/lib/python3/dist-packages/uvtool/libvirt/kvm.py", line 865, in main_create ssh_host_keys, ssh_known_hosts = uvtool.ssh.generate_ssh_host_keys() File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 50, in generate_ssh_host_keys _keygen(key_type, private_path) File "/usr/lib/python3/dist-packages/uvtool/ssh.py", line 28, in _keygen subprocess.check_call([ File "/usr/lib/python3.8/subprocess.py", line 364, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '['ssh-keygen', '-q', '-f', '/tmp/uvt-kvm.sshtmpuaqjmddo/dsa', '-N', '', '-t', 'dsa', '-C', 'root@localhost']' returned non-zero exit status 255. + cleanup =========================== [ Test Plan ] - * On both Focal and Bionic + * For both Focal and Bionic - Install a ubuntu FIPS kernel - Set the Kernel in FIPS mode by adding fips=1 to the kernel command line - Reboot the machine and check the running kernel is the expected one and Fips mode is enabled by running "cat /proc/sys/crypto/fips_enabled" and getting "1" as a result - Install the autopackage test following the guide from here https://documentation.ubuntu.com/kteam-docs/latest/how-to/testing/autotest/ - Run sudo autotest/client/autotest-local -v autotest/client/tests/ubuntu_kvm_smoke_test/control The result of the test should be for both Kernels "END GOOD", ensuring that on both Focal and Bionic FIPS the results of the ubuntu_kvm_smoke_test from autotest and observe the DSA key is discarded, but the RSA or ellyptic curve key is used for the VM; no python3 Traceback should be observed. As an example the result should contain something similar to the following snippets (uuid/architecture/timestamps... can change) =========================== ... 08:45:19 ERROR| [stderr] + uvt-kvm create bjf-test release=focal arch=amd64 08:45:21 ERROR| [stderr] sshkey_generate failed 08:45:22 ERROR| [stderr] sshkey_generate failed 08:45:25 ERROR| [stderr] + uvt-kvm wait --timeout 720 bjf-test --insecure --ssh-private-key-file /home/ubuntu/.ssh/id_rsa 08:46:29 ERROR| [stderr] ++ virsh -c qemu:///system domuuid bjf-test 08:46:29 ERROR| [stderr] + uuid=6065684f-8760-4f84-8e41-2a912cd8eab4 08:46:29 ERROR| [stderr] ++ uvt-kvm ip bjf-test ... - 08:46:35 INFO | END GOOD ubuntu_kvm_smoke_test.kvm_smoke_test ubuntu_kvm_smoke_test.kvm_smoke_test timestamp=1787733995 localtime=Aug 26 08:46:35 + 08:46:35 INFO | END GOOD ubuntu_kvm_smoke_test.kvm_smoke_test ubuntu_kvm_smoke_test.kvm_smoke_test timestamp=1787733995 localtime=Aug 26 08:46:35 08:46:35 DEBUG| Persistent state client._record_indent now set to 1 08:46:35 DEBUG| Persistent state client.unexpected_reboot deleted - 08:46:35 INFO | END GOOD ---- ---- timestamp=1787733995 localtime=Aug 26 08:46:35 + 08:46:35 INFO | END GOOD ---- ---- timestamp=1787733995 localtime=Aug 26 08:46:35 =========================== [ Fix ] * The fix consists in backporting the commit https://git.launchpad.net/uvtool/commit/?id=0e92d8b6e6ddd766f41824a52d8af0f221f0f9fd already present in newer packages. The fix has been already approved in the past in this merge request https://code.launchpad.net/~paelzer/uvtool/+git/uvtool/+merge/405796 [ Where problem could occur ] * Changes are isolated to ssh.py, no impact is expected, as the fix only increases the number of algorithms to be used before failing. [ Original report ] After enabling the fips-dev ppa and using user-space tool there. The ubuntu_kvm_smoke_test starts failing with: + uvt-kvm create bjf-test release=bionic arch=s390x DSA keys are not allowed in FIPS mode Take a closer look inside /usr/lib/python2.7/dist- packages/uvtool/libvirt/kvm.py, which calls uvtool.ssh.generate_ssh_host_keys() from /usr/lib/python2.7/dist- packages/uvtool/ssh.py From ssh.py, you will find it will try to generate 4 different key types, includes "dsa": KEY_TYPES = ['rsa', 'dsa', 'ecdsa', 'ed25519'] ... def generate_ssh_host_keys(): cloud_init_result = {} known_hosts_result = [] tmp_dir = tempfile.mkdtemp(prefix='uvt-kvm.sshtmp') try: for key_type in KEY_TYPES: private_path = os.path.join(tmp_dir, key_type) _keygen(key_type, private_path) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2057867 Title: ubuntu_kvm_smoke_test fail with FIPS kernel (dsa keys not allowed) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/2057867/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
