https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/NETCONF-521 netconf <p>The netconf Key auth suite is failing in oxygen:</p> <p> <a href="https://jenkins.opendaylight.org/releng/view/netconf/job/netconf-csit-1node-userfeatures-all-oxygen/" class="external-link" target="_blank" rel="nofollow noopener">https://jenkins.opendaylight.org/releng/view/netconf/job/netconf-csit-1node-userfeatures-all-oxygen/</a> </p> <p> </p> <p>In karaf log I see:</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"> 2018-03-02T00:38:15,881 | WARN  | sshd-SshClient[5dede481]-nio2-thread-2 | AcceptAllServerKeyVerifier       | 155 - org.apache.sshd.core - 1.6.0 | Server at /10.30.170.85:830 presented unverified RSA key: SHA256:4JBIKB6++B4Qr/W1OITOQluaBl08omQ9SuAHvLic9RI 2018-03-02T00:38:16,348 | WARN  | sshd-SshClient[5dede481]-nio2-thread-4 | AsyncSshHandler                  | 439 - org.opendaylight.netconf.netty-util - 1.4.0.SNAPSHOT | Unable to setup SSH connection on channel: [id: 0x94296797] org.apache.sshd.common.SshException: No more authentication methods available at org.apache.sshd.client.session.ClientUserAuthService.tryNext(ClientUserAuthService.java:314) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.client.session.ClientUserAuthService.processUserAuth(ClientUserAuthService.java:251) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.client.session.ClientUserAuthService.process(ClientUserAuthService.java:198) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:566) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:499) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1413) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:460) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:66) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.io.nio2.Nio2Session.handleReadCycleCompletion(Nio2Session.java:284) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:264) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:261) ~[155:org.apache.sshd.core:1.6.0] at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.lambda$completed$0(Nio2CompletionHandler.java:38) ~[155:org.apache.sshd.core:1.6.0] at java.security.AccessController.doPrivileged(Native Method) ~[?:?] at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.completed(Nio2CompletionHandler.java:37) [155:org.apache.sshd.core:1.6.0] at sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:126) [?:?] at sun.nio.ch.Invoker$2.run(Invoker.java:218) [?:?] at sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:112) [?:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:?] at java.lang.<span class="code-object">Thread</span>.run(<span class="code-object">Thread</span>.java:748) [?:?]  </pre> </div></div> <p> </p> <p>This works in Nitrogen so unless I am missing something here, this is a BLOCKER for Oxygen.</p> NETCONF-521

Netconf with Key auth does not work

Bug Highest Resolved Done Luis Gomez Luis Gomez patch_merged Fri, 2 Mar 2018 21:26:56 +0000 Thu, 8 Mar 2018 16:56:09 +0000 Thu, 8 Mar 2018 16:55:16 +0000 Oxygen Oxygen netconf 0 4 <p>Similar ERROR "No more authentication methods available" is also seen here:</p> <p><a href="https://jenkins.opendaylight.org/releng/view/netconf/job/netconf-csit-1node-callhome-only-oxygen/" class="external-link" target="_blank" rel="nofollow noopener">https://jenkins.opendaylight.org/releng/view/netconf/job/netconf-csit-1node-callhome-only-oxygen/</a></p> <p>So this issue seems to impact other netconf suites.</p> <p>OK, it seems Key auth has been refactored in Oxygen:</p> <p><a href="https://git.opendaylight.org/gerrit/#/q/topic:keyauth-refactor" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/q/topic:keyauth-refactor</a></p> <p>Someone will have to explain how this works to modify the existing tests and verify for Oxygen.</p> <p>Is it still a blocker?</p> <p>Ryan, there is new API in netconf to store public keys and certificates:</p> <p><a href="https://git.opendaylight.org/gerrit/#/c/67711/3/netconf/sal-netconf-connector/src/main/yang/netconf-keystore.yang" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/67711/3/netconf/sal-netconf-connector/src/main/yang/netconf-keystore.yang</a></p> <p>Do you know why this is in netconf and not in aaa?</p> <p>OK, so after testing the new API+implementation, I am blocked at writing the correct private-key data in the add-keystore-entry RPC:</p> <p>1) If I try to just write the raw private-key data:</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"> POST http:<span class="code-comment">//127.0.0.1:8181/restconf/operations/netconf-keystore:add-keystore-entry </span>&lt;input xmlns=<span class="code-quote">"urn:opendaylight:netconf:keystore"</span>&gt; &lt;key-credential&gt; &lt;key-id&gt;device-key&lt;/key-id&gt; &lt;<span class="code-keyword">private</span>-key&gt;MIIEpAIBAAKCAQEA1XU/F3AF8idl6+4807uonK5ZQ/F9lWfIiEXJjPLOoMgl2zQgqM4ojkgFCrwDP8KVXu ... MlQAzCDDXzDHkrgw==&lt;/<span class="code-keyword">private</span>-key&gt; &lt;passphrase&gt;&lt;/passphrase&gt; &lt;/key-credential&gt; &lt;/input&gt; </pre> </div></div> <p> <br/> controller fails (NPE) to decode the private-key because it is expecting a FileStream format where we should be passing the full content of a private-key file:</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"> -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA1XU/F3AF8idl6+4807uonK5ZQ/F9lWfIiEXJjPLOoMgl2zQg ... 13Gi2kUB8/nZGJy4CNkMpJY50xxdqN4OsE5SNdMlQAzCDDXzDHkrgw== -----END RSA PRIVATE KEY----- </pre> </div></div> <p>2) If I add the header and footer in the RPC input:</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"> POST http:<span class="code-comment">//127.0.0.1:8181/restconf/operations/netconf-keystore:add-keystore-entry </span>&lt;input xmlns=<span class="code-quote">"urn:opendaylight:netconf:keystore"</span>&gt; &lt;key-credential&gt; &lt;key-id&gt;device-key&lt;/key-id&gt; &lt;<span class="code-keyword">private</span>-key&gt;-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA1XU/F3AF8idl6+4807uonK5ZQ/F9lWfIiEXJjPLOoMgl2zQgqM4ojkgFCrwDP8KVXu ... MlQAzCDDXzDHkrgw==\n-----END RSA PRIVATE KEY-----&lt;/<span class="code-keyword">private</span>-key&gt; &lt;passphrase&gt;&lt;/passphrase&gt; &lt;/key-credential&gt; &lt;/input&gt; </pre> </div></div> <p>controller fails to decode the above because it cannot detect the "new line" (\n) character in the string above.</p> <p>So any suggestion on how to pass the private-key in the RPC input so that the "PEMParser keyReader = new PEMParser(reader)" in <a href="https://git.opendaylight.org/gerrit/#/c/64657/1/aaa-encrypt-service/src/main/java/org/opendaylight/aaa/encrypt/PKIUtil.java" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/64657/1/aaa-encrypt-service/src/main/java/org/opendaylight/aaa/encrypt/PKIUtil.java</a> works fine?</p> <p>Strip out the newlines and it should work to my knowledge.  i.e., keep the "BEGIN" and "END" stuff but no newlines.</p> <p>Tried that already and it does not find the the footer:</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"> 2018-03-07T08:02:42,690 | WARN | opendaylight-cluster-data-notification-dispatcher-279 | DatastoreBackedPublicKeyAuth | 301 - org.opendaylight.netconf.sal-netconf-connector - 1.7.0.SNAPSHOT | Unable to decode <span class="code-keyword">private</span> key, id=device-key java.io.IOException: -----END RSA PRIVATE KEY not found at org.bouncycastle.util.io.pem.PemReader.loadObject(Unknown Source) [10:bcprov:1.58.0] at org.bouncycastle.util.io.pem.PemReader.readPemObject(Unknown Source) [10:bcprov:1.58.0] at org.bouncycastle.openssl.PEMParser.readObject(Unknown Source) [11:bcpkix:1.58.0] at org.opendaylight.aaa.encrypt.PKIUtil.doDecodePrivateKey(PKIUtil.java:215) [187:org.opendaylight.aaa.encrypt-service:0.7.0.SNAPSHOT] at org.opendaylight.aaa.encrypt.PKIUtil.decodePrivateKey(PKIUtil.java:202) [187:org.opendaylight.aaa.encrypt-service:0.7.0.SNAPSHOT] at org.opendaylight.netconf.sal.connect.netconf.auth.DatastoreBackedPublicKeyAuth.tryToSetKeyPair(DatastoreBackedPublicKeyAuth.java:74) [301:org.opendaylight.netconf.sal-netconf-connector:1.7.0.SNAPSHOT] at org.opendaylight.netconf.sal.connect.netconf.auth.DatastoreBackedPublicKeyAuth.&lt;init&gt;(DatastoreBackedPublicKeyAuth.java:46) [301:org.opendaylight.netconf.sal-netconf-connector:1.7.0.SNAPSHOT] at org.opendaylight.netconf.topology.AbstractNetconfTopology.getHandlerFromCredentials(AbstractNetconfTopology.java:483) [117:netconf-topology-config:1.4.0.SNAPSHOT] at org.opendaylight.netconf.topology.AbstractNetconfTopology.getClientConfig(AbstractNetconfTopology.java:448) [117:netconf-topology-config:1.4.0.SNAPSHOT] at org.opendaylight.netconf.topology.AbstractNetconfTopology.setupConnection(AbstractNetconfTopology.java:242) [117:netconf-topology-config:1.4.0.SNAPSHOT] at org.opendaylight.netconf.topology.AbstractNetconfTopology.connectNode(AbstractNetconfTopology.java:212) [117:netconf-topology-config:1.4.0.SNAPSHOT] at org.opendaylight.netconf.topology.impl.NetconfTopologyImpl.onDataTreeChanged(NetconfTopologyImpl.java:126) [117:netconf-topology-config:1.4.0.SNAPSHOT] at org.opendaylight.controller.md.sal.binding.impl.BindingDOMDataTreeChangeListenerAdapter.onDataTreeChanged(BindingDOMDataTreeChangeListenerAdapter.java:41) [211:org.opendaylight.controller.sal-binding-broker-impl:1.7.0.SNAPSHOT] at org.opendaylight.controller.cluster.datastore.DataTreeChangeListenerActor.dataChanged(DataTreeChangeListenerActor.java:67) [224:org.opendaylight.controller.sal-distributed-datastore:1.7.0.SNAPSHOT] at org.opendaylight.controller.cluster.datastore.DataTreeChangeListenerActor.handleReceive(DataTreeChangeListenerActor.java:41) [224:org.opendaylight.controller.sal-distributed-datastore:1.7.0.SNAPSHOT] at org.opendaylight.controller.cluster.common.actor.AbstractUntypedActor.onReceive(AbstractUntypedActor.java:38) [217:org.opendaylight.controller.sal-clustering-commons:1.7.0.SNAPSHOT] at akka.actor.UntypedActor$$anonfun$receive$1.applyOrElse(UntypedActor.scala:166) [83:com.typesafe.akka.actor:2.5.4] at akka.actor.Actor.aroundReceive(Actor.scala:514) [83:com.typesafe.akka.actor:2.5.4] at akka.actor.Actor.aroundReceive$(Actor.scala:512) [83:com.typesafe.akka.actor:2.5.4] at akka.actor.UntypedActor.aroundReceive(UntypedActor.scala:96) [83:com.typesafe.akka.actor:2.5.4] at akka.actor.ActorCell.receiveMessage(ActorCell.scala:527) [83:com.typesafe.akka.actor:2.5.4] at akka.actor.ActorCell.invoke(ActorCell.scala:496) [83:com.typesafe.akka.actor:2.5.4] at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:257) [83:com.typesafe.akka.actor:2.5.4] at akka.dispatch.Mailbox.run(Mailbox.scala:224) [83:com.typesafe.akka.actor:2.5.4] at akka.dispatch.Mailbox.exec(Mailbox.scala:234) [83:com.typesafe.akka.actor:2.5.4] at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260) [83:com.typesafe.akka.actor:2.5.4] at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339) [83:com.typesafe.akka.actor:2.5.4] at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979) [83:com.typesafe.akka.actor:2.5.4] at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107) [83:com.typesafe.akka.actor:2.5.4] 2 </pre> </div></div> <p>OK, after googling how to convert the literal '\n' into an effective newline I came up with:<br/> <a href="https://git.opendaylight.org/gerrit/#/c/69249/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/69249/</a><br/> I also tested the patch in sandbox and it works.</p> <p>69249 has a +2 and is ready to be merged.</p> <p>The patch has been merged. <a href="https://jira.opendaylight.org/secure/ViewProfile.jspa?name=ecelgp" class="user-hover" rel="ecelgp">ecelgp</a> can you verify it fixed the problem and close this issue?</p> <p>Sure it works, I already verified before it was merged. Closing this then.</p> <p>Fix provided, merged and verified.</p> <p>Only thing missing here as well as for <a href="https://jira.opendaylight.org/browse/NETCONF-520" title="RPC add netconf device does not work" class="issue-link" data-issue-key="NETCONF-520"><del>NETCONF-520</del></a> is update user guide but we can open a separate ticket for that.</p> Development Rank 0|i03b3b: