You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2021/06/03 23:42:18 UTC
[GitHub] [trafficcontrol] shamrickus opened a new issue #5914: TO PSQL plugin does not update SSLKeys correctly
shamrickus opened a new issue #5914:
URL: https://github.com/apache/trafficcontrol/issues/5914
<!--
************ STOP!! ************
If this issue identifies a security vulnerability, DO NOT submit it! Instead, contact
the Apache Traffic Control Security Team at security@trafficcontrol.apache.org and follow the
guidelines at https://www.apache.org/security/ regarding vulnerability disclosure.
- For *SUPPORT QUESTIONS*, use the #traffic-control channel on the ASF slack (https://s.apache.org/slack-invite)
or Traffic Control mailing lists (https://trafficcontrol.apache.org/mailing_lists).
- Before submitting, please **SEARCH GITHUB** for a similar issue or PR.
-->
## I'm submitting a ...
<!-- delete all those that don't apply -->
<!--- security vulnerability (STOP!! - see above)-->
- bug report
## Traffic Control components affected ...
<!-- delete all those that don't apply -->
- Traffic Ops
- Traffic Vault
## Current behavior:
When `tv.GetDeliveryServiceSSLKeys` gets called with the PSQL backend, the actual encrypted value (`tc.DeliveryServiceSSLKeys`) does not get it's `Version` field updated appropriately. This manifests in that any `DeliveryServiceSSLKeys.Version` will be `1` while the corresponding table value is correct.
<!-- Describe how the bug manifests -->
## Expected behavior:
The `DeliveryServiceSSLKeys.Version` should match the version column on the `sslkey` table.
<!-- Describe what the behavior would be without the bug -->
## Minimal reproduction of the problem with instructions:
Might be able to skip DNSSec/URI/URL keys step:
- Create CDN
- Generate DNSSec Keys
- Create DS
- Generate SSL Keys
- Generate URI Keys
- Generate URL Keys
Query the TV DB (with PSQL backend), decode the value and see that the version on the table and the version on `DeliveryServiceSSLKeys` are not correct in the case of `latest`
<!--
If the current behavior is a bug, please provide the *STEPS TO REPRODUCE* and
include the applicable TC version.
-->
## Anything else:
<!--
e.g. stacktraces, related issues, suggestions how to fix (feel free to delete
this section)
-->
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
https://apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
### From default CiaB:
SSL Keys JSON:
```
{
"cdn": "CDN-in-a-Box",
"deliveryservice": "demo1",
"hostname": "*.demo1.mycdn.ciab.test",
"key": "demo1",
"version": 1,
"certificate": {
"crt": "...",
"key": "...",
"csr": "..."
},
"LastUpdated": "2021-06-03T20:40:57.812723Z"
},
{
"cdn": "CDN-in-a-Box",
"deliveryservice": "demo1",
"hostname": "*.demo1.mycdn.ciab.test",
"key": "demo1",
"version": 1,
"certificate": {
"crt": "...",
"key": "...",
"csr": "..."
},
"LastUpdated": "2021-06-03T20:40:57.812723Z"
},
```
Corresponding table records:
```
id, data, ds, cdn, version, last_update
1, '...', demo1, CDN-in-a-Box, 1, 2021-06-03 20:40:57.812723
2, '...', demo1, CDN-in-a-Box, latest, 2021-06-03 20:40:57.812723
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] shamrickus closed issue #5914: TO PSQL plugin does not update SSLKeys correctly
Posted by GitBox <gi...@apache.org>.
shamrickus closed issue #5914:
URL: https://github.com/apache/trafficcontrol/issues/5914
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] shamrickus commented on issue #5914: TO PSQL plugin does not update SSLKeys correctly
Posted by GitBox <gi...@apache.org>.
shamrickus commented on issue #5914:
URL: https://github.com/apache/trafficcontrol/issues/5914#issuecomment-857876175
After talking with @mattjackson220, I realize I have misunderstood the purpose of the double key entry. Two are inserted with different versions on the record so it can be searched. I was under the impression that we were storing the most recent key, and the key before that (which should have different versions).
This is not actually an issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org