Skip to content

server: use ecdsa instead of ed25519 when generate public/private keys#8719

Merged
weizhouapache merged 1 commit intoapache:4.18from
weizhouapache:4.18-create-ecdsa-key
Mar 3, 2024
Merged

server: use ecdsa instead of ed25519 when generate public/private keys#8719
weizhouapache merged 1 commit intoapache:4.18from
weizhouapache:4.18-create-ecdsa-key

Conversation

@weizhouapache
Copy link
Copy Markdown
Member

@weizhouapache weizhouapache commented Feb 28, 2024 •
edited
Loading

Description

This PR replaces ed25519 with ecdsa.

PR #8549 replaced RSA with ed25519. Unfornately, ed25519 keys is unsupported in FIPS mode

$  ssh-keygen -t ed25519 -m PEM -N '' -f key1
ED25519 keys are not allowed in FIPS mode

$  ssh-keygen -t ecdsa -m PEM -N '' -f key1
Generating public/private ecdsa key pair.
Your identification has been saved in key1
Your public key has been saved in key1.pub
The key fingerprint is:
.........

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)
  • build/CI

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

  • Major
  • Minor

Bug Severity

  • BLOCKER
  • Critical
  • Major
  • Minor
  • Trivial

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

@weizhouapache
server: use ecdsa instead of ed25519 when generate public/private keys
a1a2947 
PR apache#8549 replaced RSA with ed25519. unfornately, ed25519 is unsupported in FIPS mode

```
$  ssh-keygen -t ed25519 -m PEM -N '' -f key1
ED25519 keys are not allowed in FIPS mode

$  ssh-keygen -t ecdsa -m PEM -N '' -f key1
Generating public/private ecdsa key pair.
Your identification has been saved in key1
Your public key has been saved in key1.pub
The key fingerprint is:
.........

```
@weizhouapache weizhouapache added this to the 4.18.2.0 milestone Feb 28, 2024
@weizhouapache
Copy link
Copy Markdown
Member Author

weizhouapache commented Feb 28, 2024

@blueorangutan package

DaanHoogland
DaanHoogland approved these changes Feb 28, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@DaanHoogland DaanHoogland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clgtm

@DaanHoogland
Copy link
Copy Markdown
Contributor

DaanHoogland commented Feb 28, 2024

@blueorangutan package

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Feb 28, 2024

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

@codecov
Copy link
Copy Markdown

codecov Bot commented Feb 28, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 0% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 13.16%. Comparing base (4e34e6b) to head (a1a2947).
Report is 2 commits behind head on 4.18.

Files Patch % Lines
...java/com/cloud/server/ConfigurationServerImpl.java 0.00% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff            @@
##               4.18    #8719   +/-   ##
=========================================
  Coverage     13.16%   13.16%           
  Complexity     9203     9203           
=========================================
  Files          2724     2724           
  Lines        258130   258130           
  Branches      40232    40232           
=========================================
  Hits          33989    33989           
  Misses       219833   219833           
  Partials       4308     4308

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Feb 28, 2024

Packaging result [SF]: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 8807

@DaanHoogland
Copy link
Copy Markdown
Contributor

DaanHoogland commented Feb 28, 2024

@blueorangutan test alma9 kvm-alma9

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Feb 28, 2024

@DaanHoogland a [SL] Trillian-Jenkins test job (alma9 mgmt + kvm-alma9) has been kicked to run smoke tests

sureshanaparti
sureshanaparti approved these changes Feb 28, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@sureshanaparti sureshanaparti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CLGTM

@DaanHoogland DaanHoogland added the Severity:Critical Critical bug label Feb 28, 2024
vishesh92
vishesh92 reviewed Feb 28, 2024
View reviewed changes
Copy link
Copy Markdown
Member

@vishesh92 vishesh92 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clgtm

JoaoJandre
JoaoJandre approved these changes Feb 28, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@JoaoJandre JoaoJandre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CLGTM, didn't test it

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Feb 28, 2024

[SF] Trillian test result (tid-9339)
Environment: kvm-alma9 (x2), Advanced Networking with Mgmt server a9
Total time taken: 43892 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8719-t9339-kvm-alma9.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@weizhouapache
Copy link
Copy Markdown
Member Author

weizhouapache commented Mar 2, 2024

@blueorangutan test matrix

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Mar 2, 2024

@weizhouapache a [SL] Trillian-Jenkins matrix job (centos7 mgmt + xenserver71, rocky8 mgmt + vmware67u3, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Mar 2, 2024

[SF] Trillian Build Failed (tid-9367)

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Mar 3, 2024

[SF] Trillian test result (tid-9366)
Environment: xenserver-71 (x2), Advanced Networking with Mgmt server 7
Total time taken: 38643 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8719-t9366-xenserver-71.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Mar 3, 2024

[SF] Trillian test result (tid-9368)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 40688 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8719-t9368-kvm-centos7.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@blueorangutan
Copy link
Copy Markdown

blueorangutan commented Mar 3, 2024

[SF] Trillian test result (tid-9369)
Environment: vmware-67u3 (x2), Advanced Networking with Mgmt server u22
Total time taken: 51056 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8719-t9369-vmware-67u3.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@weizhouapache weizhouapache merged commit 10f72a1 into apache:4.18 Mar 3, 2024
@DaanHoogland DaanHoogland deleted the 4.18-create-ecdsa-key branch March 4, 2024 08:25
dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Mar 5, 2024
@weizhouapache @dhslove
server: use ecdsa instead of ed25519 when generate public/private keys (
f3f266c 
apache#8719)

PR apache#8549 replaced RSA with ed25519. unfornately, ed25519 is unsupported in FIPS mode

```
$  ssh-keygen -t ed25519 -m PEM -N '' -f key1
ED25519 keys are not allowed in FIPS mode

$  ssh-keygen -t ecdsa -m PEM -N '' -f key1
Generating public/private ecdsa key pair.
Your identification has been saved in key1
Your public key has been saved in key1.pub
The key fingerprint is:
.........

```
@rwdj rwdj mentioned this pull request Apr 14, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vishesh92 vishesh92 vishesh92 left review comments

@yadvr yadvr yadvr approved these changes

@DaanHoogland DaanHoogland DaanHoogland approved these changes

@sureshanaparti sureshanaparti sureshanaparti approved these changes

@JoaoJandre JoaoJandre JoaoJandre approved these changes

Assignees

No one assigned

Labels

component:management-server Severity:Critical Critical bug

Projects

None yet

Milestone

4.18.2.0

Development

Successfully merging this pull request may close these issues.

7 participants

@weizhouapache @DaanHoogland @blueorangutan @yadvr @vishesh92 @sureshanaparti @JoaoJandre