- Devel - oVirt List Archives

PROBLEM: Unable to retrieve value for MTU when default is used
by james.holohan＠oracle.com 26 Sep '19

26 Sep '19

I'm trying to automate a test which checks that the default values are being set correctly when adding a network to a host. When I create a network without specifying a value for the MTU, I can see from the web UI that the default value (1500) is being used. When I try to retrieve this MTU value from the SDK to ensure it is set correctly, the value returned is '0'. The same issue is not occurring if I explicitly set the MTU value when creating the network. When the MTU value is assigned, instead of using the default value, it is possible to retrieve it from the SDK correctly. Is there any way I can retrieve the value for MTU from the SDK when the default is used?

3 4

[ACTION REQUIRED] unicode patches merged, update otopi
by Yedidyah Bar David 26 Sep '19

26 Sep '19

Hi all, I now merged my pending patches to make otopi use unicode strings for "everything" (well, partially, for now) instead of "str" in python2. There were two stacks of patches - one for the engine and one for otopi. So if you git pull from the engine and it breaks, try to update otopi and see if it helps. If not, ping me :-) Best regards, -- Didi

1 1

planned Jenkins restart
by Evgheni Dereveanchin 26 Sep '19

26 Sep '19

Hi everyone, I'll be performing a planned Jenkins restart within the next hour. No new jobs will be scheduled during this maintenance period. I will inform you once it is back online. -- Regards, Evgheni Dereveanchin

1 1

CI is not triggered for pushed gerrit updates
by Amit Bawer 25 Sep '19

25 Sep '19

CI has stopped from being triggered for pushed gerrit updates. Example at: https://gerrit.ovirt.org/#/c/103320/ last PS did not trigger CI tests. Please advise.

3 3

PROBLEM: Issue has been detected with gerrit trigger.
by Ehud Yonasi 25 Sep '19

25 Sep '19

Hey everyone, A problem was identified that causes the CI not working with gerrit patches. We are working on fixing the automatic triggering and bringing it online asap. We are sorry for the inconvenience at the moment. If you want to run the CI for your patch atm you can use the manual gerrit trigger job: https://jenkins.ovirt.org/gerrit_manual_trigger/ Regards, Ehud.

1 2

vdsm has been tagged (v4.30.33)
by Milan Zamazal 24 Sep '19

24 Sep '19

1 0

ovirt-engine has been tagged (ovirt-engine-4.3.5.6)
by Tal Nisan 24 Sep '19

24 Sep '19

1 0

unicode sandwich in otopi/engine-setup
by Yedidyah Bar David 24 Sep '19

24 Sep '19

Hi all, This is in a sense a continuation of the thread "Why filetransaction needs to encode the content to utf-8?", but I decided that a new thread is better. I started to systematically convert the code to use a unicode sandwich. I admit it was harder than I expected, and made me think somewhat differently about the move to python3, and about how reasonable (or not) it is to develop in the common subset of python2 and python3 vs ditching python2 and moving fully to python3. It seems like at least parts of our (integration team) code will still have to run in python2 also in oVirt 4.4, so I guess we'll not have much choice :-) Current patches are only for otopi and engine-setup, and are by no means thorough - I didn't check each and every open() call and similar ones. But it's enough for getting engine-setup finish successfully on both python2 and python3 (EL7 and Fedora 29), with some utf-8 inserted in relevant places of the input (for the plugins already handled). I didn't bother trying non-utf-8 encodings. Perhaps I should, but it's not completely clear to me what's the best approach [2]. Currently, you must have both otopi and engine updated to get things working. If there is demand, I might spend some time splitting/rebasing/etc to make it possible to update just one of them and only later the other, but not sure it's worth it. I don't mind splitting/squashing if it makes reviews simpler, but I think the patches are ok as-is. These are the bottom patches of each stack: otopi: https://gerrit.ovirt.org/102085 engine-setup: https://gerrit.ovirt.org/102934 [1] http://python-future.org/unicode_literals.html [2] https://stackoverflow.com/questions/4012571/python-which-encoding-is-used-f… Thanks and best regards, -- Didi

2 5

ovirt-engine has been tagged (ovirt-engine-4.3.6.6)
by Tal Nisan 23 Sep '19

23 Sep '19

1 0

Re: Certificate checking on TLS migrations to an IP address
by Milan Zamazal 23 Sep '19

23 Sep '19

Daniel P. Berrangé <berrange(a)redhat.com> writes: > On Wed, Sep 04, 2019 at 03:38:25PM +0200, Milan Zamazal wrote: >> Hi, I'm trying to add TLS migrations to oVirt, but I've hit a problem >> with certificate checking. > >> >> oVirt uses the destination host IP address, rather than the host name, >> in the migration URI passed to virDomainMigrateToURI3. One reason for >> doing that is that a separate migration network may be used for >> migrations, while the host name resolves to the management network >> interface. >> >> But it causes a problem with certificate checking. The destination IP >> address is checked against the name, which is a host name, given in the >> destination certificate. That means there is mismatch and the migration >> fails. I don't think it'd be a very good idea to avoid the problem by >> putting IP addresses into server certificates. > > In fact that is *exactly* what you should be doing. > > Traditionally certificates were created with the 'common name' field > holding the fully qualified DNS based hostname for the server. > > This was long known to be a problem because it is very common for > servers to have multiple DNS names, or for clients to use the > unqualified hostname, or use the IP address(es). The problem with putting IP addresses into certificates is that the certificate must be updated each time an IP address changes, is added or is removed. Doing this in oVirt would be complicated and error-prone. While host names are stable, host networks and the related IP addresses may change. > Thus, the "Subject alt name" extension was created. This allows > certificates to be created containing multiple hostnames and > multiple IP addresses. The certificate will be validated correctly > if any one of those data items matches. When 'subject alt name' is > present in a certificate, the 'common name' field should be completely > ignored by compliant TLS clients, so you are free to put whatever > you want in the common name - hostname or IP address or blah... We can switch to using Subject Alt Name and we have a patch for that now based on your advice, but it doesn't solve the problem with tracking IP address changes and updating the corresponding certificates whenever a change occurs. > If you look at our docs, we updated them to illustrate how to > issue certs containing hostnames + IP addresses: > > https://libvirt.org/remote.html#Remote_TLS_server_certificates > >> >> Is there any way to make TLS migrations working under these >> circumstances? For instance, SPICE remote-viewer allows the client to >> specify the certificate subject to expect on the host when connecting to >> it using an IP address. Can (or could) libvirt do something similar? Would it be possible? We have host names in the certificates under our control and we know which host name to expect in the certificate regardless the IP address used for the given connection. Checking the certificate against a given host name would solve the problem easily and robustly for us. >> Or is there any other mechanism to handle this problem? Thanks, Milan

2 4