[NETCONF-521] Netconf with Key auth does not work Created: 02/Mar/18  Updated: 08/Mar/18  Resolved: 08/Mar/18

Status: Resolved
Project: netconf
Component/s: netconf
Affects Version/s: Oxygen
Fix Version/s: Oxygen

Type: Bug Priority: Highest
Reporter: Luis Gomez Assignee: Luis Gomez
Resolution: Done Votes: 0
Labels: patch_merged
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified


 Description   

The netconf Key auth suite is failing in oxygen:

 https://jenkins.opendaylight.org/releng/view/netconf/job/netconf-csit-1node-userfeatures-all-oxygen/ 

 

In karaf log I see:

2018-03-02T00:38:15,881 | WARN  | sshd-SshClient[5dede481]-nio2-thread-2 | AcceptAllServerKeyVerifier       | 155 - org.apache.sshd.core - 1.6.0 | Server at /10.30.170.85:830 presented unverified RSA key: SHA256:4JBIKB6++B4Qr/W1OITOQluaBl08omQ9SuAHvLic9RI

2018-03-02T00:38:16,348 | WARN  | sshd-SshClient[5dede481]-nio2-thread-4 | AsyncSshHandler                  | 439 - org.opendaylight.netconf.netty-util - 1.4.0.SNAPSHOT | Unable to setup SSH connection on channel: [id: 0x94296797]

org.apache.sshd.common.SshException: No more authentication methods available

at org.apache.sshd.client.session.ClientUserAuthService.tryNext(ClientUserAuthService.java:314) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.client.session.ClientUserAuthService.processUserAuth(ClientUserAuthService.java:251) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.client.session.ClientUserAuthService.process(ClientUserAuthService.java:198) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:566) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:499) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1413) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:460) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:66) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.io.nio2.Nio2Session.handleReadCycleCompletion(Nio2Session.java:284) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:264) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:261) ~[155:org.apache.sshd.core:1.6.0]

at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.lambda$completed$0(Nio2CompletionHandler.java:38) ~[155:org.apache.sshd.core:1.6.0]

at java.security.AccessController.doPrivileged(Native Method) ~[?:?]

at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.completed(Nio2CompletionHandler.java:37) [155:org.apache.sshd.core:1.6.0]

at sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:126) [?:?]

at sun.nio.ch.Invoker$2.run(Invoker.java:218) [?:?]

at sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:112) [?:?]

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:?]

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:?]

at java.lang.Thread.run(Thread.java:748) [?:?]

 

 

This works in Nitrogen so unless I am missing something here, this is a BLOCKER for Oxygen.

 Comments   
Comment by Luis Gomez [ 05/Mar/18 ]

Similar ERROR "No more authentication methods available" is also seen here:

https://jenkins.opendaylight.org/releng/view/netconf/job/netconf-csit-1node-callhome-only-oxygen/

So this issue seems to impact other netconf suites.

Comment by Luis Gomez [ 05/Mar/18 ]

OK, it seems Key auth has been refactored in Oxygen:

https://git.opendaylight.org/gerrit/#/q/topic:keyauth-refactor

Someone will have to explain how this works to modify the existing tests and verify for Oxygen.

Comment by Ryan Goulding [ 06/Mar/18 ]

Is it still a blocker?

Comment by Luis Gomez [ 06/Mar/18 ]

Ryan, there is new API in netconf to store public keys and certificates:

https://git.opendaylight.org/gerrit/#/c/67711/3/netconf/sal-netconf-connector/src/main/yang/netconf-keystore.yang

Do you know why this is in netconf and not in aaa?

Comment by Luis Gomez [ 07/Mar/18 ]

OK, so after testing the new API+implementation, I am blocked at writing the correct private-key data in the add-keystore-entry RPC:

1) If I try to just write the raw private-key data:

POST http://127.0.0.1:8181/restconf/operations/netconf-keystore:add-keystore-entry
<input xmlns="urn:opendaylight:netconf:keystore">
    <key-credential>
       <key-id>device-key</key-id>
       <private-key>MIIEpAIBAAKCAQEA1XU/F3AF8idl6+4807uonK5ZQ/F9lWfIiEXJjPLOoMgl2zQgqM4ojkgFCrwDP8KVXu
...
MlQAzCDDXzDHkrgw==</private-key>
        <passphrase></passphrase>
    </key-credential>
</input>

 
controller fails (NPE) to decode the private-key because it is expecting a FileStream format where we should be passing the full content of a private-key file:

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA1XU/F3AF8idl6+4807uonK5ZQ/F9lWfIiEXJjPLOoMgl2zQg
...
13Gi2kUB8/nZGJy4CNkMpJY50xxdqN4OsE5SNdMlQAzCDDXzDHkrgw==
-----END RSA PRIVATE KEY-----

2) If I add the header and footer in the RPC input:

POST http://127.0.0.1:8181/restconf/operations/netconf-keystore:add-keystore-entry
<input xmlns="urn:opendaylight:netconf:keystore">
    <key-credential>
       <key-id>device-key</key-id>
       <private-key>-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA1XU/F3AF8idl6+4807uonK5ZQ/F9lWfIiEXJjPLOoMgl2zQgqM4ojkgFCrwDP8KVXu
...
MlQAzCDDXzDHkrgw==\n-----END RSA PRIVATE KEY-----</private-key>
        <passphrase></passphrase>
    </key-credential>
</input>

controller fails to decode the above because it cannot detect the "new line" (\n) character in the string above.

So any suggestion on how to pass the private-key in the RPC input so that the "PEMParser keyReader = new PEMParser(reader)" in https://git.opendaylight.org/gerrit/#/c/64657/1/aaa-encrypt-service/src/main/java/org/opendaylight/aaa/encrypt/PKIUtil.java works fine?

Comment by Ryan Goulding [ 07/Mar/18 ]

Strip out the newlines and it should work to my knowledge.  i.e., keep the "BEGIN" and "END" stuff but no newlines.

Comment by Luis Gomez [ 07/Mar/18 ]

Tried that already and it does not find the the footer:

2018-03-07T08:02:42,690 | WARN  | opendaylight-cluster-data-notification-dispatcher-279 | DatastoreBackedPublicKeyAuth     | 301 - org.opendaylight.netconf.sal-netconf-connector - 1.7.0.SNAPSHOT | Unable to decode private key, id=device-key
java.io.IOException: -----END RSA PRIVATE KEY not found
	at org.bouncycastle.util.io.pem.PemReader.loadObject(Unknown Source) [10:bcprov:1.58.0]
	at org.bouncycastle.util.io.pem.PemReader.readPemObject(Unknown Source) [10:bcprov:1.58.0]
	at org.bouncycastle.openssl.PEMParser.readObject(Unknown Source) [11:bcpkix:1.58.0]
	at org.opendaylight.aaa.encrypt.PKIUtil.doDecodePrivateKey(PKIUtil.java:215) [187:org.opendaylight.aaa.encrypt-service:0.7.0.SNAPSHOT]
	at org.opendaylight.aaa.encrypt.PKIUtil.decodePrivateKey(PKIUtil.java:202) [187:org.opendaylight.aaa.encrypt-service:0.7.0.SNAPSHOT]
	at org.opendaylight.netconf.sal.connect.netconf.auth.DatastoreBackedPublicKeyAuth.tryToSetKeyPair(DatastoreBackedPublicKeyAuth.java:74) [301:org.opendaylight.netconf.sal-netconf-connector:1.7.0.SNAPSHOT]
	at org.opendaylight.netconf.sal.connect.netconf.auth.DatastoreBackedPublicKeyAuth.<init>(DatastoreBackedPublicKeyAuth.java:46) [301:org.opendaylight.netconf.sal-netconf-connector:1.7.0.SNAPSHOT]
	at org.opendaylight.netconf.topology.AbstractNetconfTopology.getHandlerFromCredentials(AbstractNetconfTopology.java:483) [117:netconf-topology-config:1.4.0.SNAPSHOT]
	at org.opendaylight.netconf.topology.AbstractNetconfTopology.getClientConfig(AbstractNetconfTopology.java:448) [117:netconf-topology-config:1.4.0.SNAPSHOT]
	at org.opendaylight.netconf.topology.AbstractNetconfTopology.setupConnection(AbstractNetconfTopology.java:242) [117:netconf-topology-config:1.4.0.SNAPSHOT]
	at org.opendaylight.netconf.topology.AbstractNetconfTopology.connectNode(AbstractNetconfTopology.java:212) [117:netconf-topology-config:1.4.0.SNAPSHOT]
	at org.opendaylight.netconf.topology.impl.NetconfTopologyImpl.onDataTreeChanged(NetconfTopologyImpl.java:126) [117:netconf-topology-config:1.4.0.SNAPSHOT]
	at org.opendaylight.controller.md.sal.binding.impl.BindingDOMDataTreeChangeListenerAdapter.onDataTreeChanged(BindingDOMDataTreeChangeListenerAdapter.java:41) [211:org.opendaylight.controller.sal-binding-broker-impl:1.7.0.SNAPSHOT]
	at org.opendaylight.controller.cluster.datastore.DataTreeChangeListenerActor.dataChanged(DataTreeChangeListenerActor.java:67) [224:org.opendaylight.controller.sal-distributed-datastore:1.7.0.SNAPSHOT]
	at org.opendaylight.controller.cluster.datastore.DataTreeChangeListenerActor.handleReceive(DataTreeChangeListenerActor.java:41) [224:org.opendaylight.controller.sal-distributed-datastore:1.7.0.SNAPSHOT]
	at org.opendaylight.controller.cluster.common.actor.AbstractUntypedActor.onReceive(AbstractUntypedActor.java:38) [217:org.opendaylight.controller.sal-clustering-commons:1.7.0.SNAPSHOT]
	at akka.actor.UntypedActor$$anonfun$receive$1.applyOrElse(UntypedActor.scala:166) [83:com.typesafe.akka.actor:2.5.4]
	at akka.actor.Actor.aroundReceive(Actor.scala:514) [83:com.typesafe.akka.actor:2.5.4]
	at akka.actor.Actor.aroundReceive$(Actor.scala:512) [83:com.typesafe.akka.actor:2.5.4]
	at akka.actor.UntypedActor.aroundReceive(UntypedActor.scala:96) [83:com.typesafe.akka.actor:2.5.4]
	at akka.actor.ActorCell.receiveMessage(ActorCell.scala:527) [83:com.typesafe.akka.actor:2.5.4]
	at akka.actor.ActorCell.invoke(ActorCell.scala:496) [83:com.typesafe.akka.actor:2.5.4]
	at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:257) [83:com.typesafe.akka.actor:2.5.4]
	at akka.dispatch.Mailbox.run(Mailbox.scala:224) [83:com.typesafe.akka.actor:2.5.4]
	at akka.dispatch.Mailbox.exec(Mailbox.scala:234) [83:com.typesafe.akka.actor:2.5.4]
	at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260) [83:com.typesafe.akka.actor:2.5.4]
	at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339) [83:com.typesafe.akka.actor:2.5.4]
	at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979) [83:com.typesafe.akka.actor:2.5.4]
	at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107) [83:com.typesafe.akka.actor:2.5.4]
2
Comment by Luis Gomez [ 08/Mar/18 ]

OK, after googling how to convert the literal '\n' into an effective newline I came up with:
https://git.opendaylight.org/gerrit/#/c/69249/
I also tested the patch in sandbox and it works.

Comment by Daniel Farrell [ 08/Mar/18 ]

69249 has a +2 and is ready to be merged.

Comment by Daniel Farrell [ 08/Mar/18 ]

The patch has been merged. ecelgp can you verify it fixed the problem and close this issue?

Comment by Luis Gomez [ 08/Mar/18 ]

Sure it works, I already verified before it was merged. Closing this then.

Comment by Luis Gomez [ 08/Mar/18 ]

Fix provided, merged and verified.

Comment by Luis Gomez [ 08/Mar/18 ]

Only thing missing here as well as for NETCONF-520 is update user guide but we can open a separate ticket for that.

Generated at Wed Feb 07 20:15:14 UTC 2024 using Jira 8.20.10#820010-sha1:ace47f9899e9ee25d7157d59aa17ab06aee30d3d.