[Bug 837513] New: request-tracker package in devel:languages:perl has an issue (rt-mailgate)
https://bugzilla.novell.com/show_bug.cgi?id=837513 https://bugzilla.novell.com/show_bug.cgi?id=837513#c0 Summary: request-tracker package in devel:languages:perl has an issue (rt-mailgate) Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: x86-64 OS/Version: openSUSE 12.3 Status: NEW Severity: Normal Priority: P5 - None Component: Other AssignedTo: lrupp@suse.com ReportedBy: ncutler@suse.com QAContact: qa-bugs@suse.de Found By: Field Engineer Blocker: --- rt-mailgate is a critical component of Request Tracker (package 'request-tracker' in project 'devel:languages:perl') As it currently stands, in openSUSE or SLE11-SP2 I can get rt-mailgate to communicate with the server using SSL encryption (https) *only* if I explicitly provide the --ca-file option to rt-mailgate. Even this is a bug; rt-mailgate should be able to find the Trust Root certificate itself. Still, at least it worked. Today I upgraded our RT server to SLE11-SP3, and rt-mailgate stopped working over SSL completely. The MTA passes the email to rt-mailgate, but rt-mailgate does nothing and eventually times out. I can reproduce the bug (on SLE11-SP3) by issuing the following command: # echo "hello" | /usr/bin/rt-mailgate --debug --queue General --action correspond --ca-file /etc/ssl/certs/Trust-Root.crt.pem --url https://our.rt.instance This generates the following output: /usr/bin/rt-mailgate: temp file is '/tmp/OOT6t4Rcoi/TsM08ZYrQV' /usr/bin/rt-mailgate: connecting to https://our.rt.instance/REST/1.0/NoAuth/mail-gateway Nothing further happens. I have worked around the issue by having rt-mailgate communicate without SSL (http). This works fine: # echo "hello" |/usr/bin/rt-mailgate --debug --queue rt_internal --action comment --url http://our.rt.instance /usr/bin/rt-mailgate: temp file is '/tmp/cdJXHiPXWr/IgReSdTbFr' /usr/bin/rt-mailgate: connecting to http://our.rt.instance/REST/1.0/NoAuth/mail-gateway not ok - Could not load a valid user # Or, if I provide a valid email: # cat testmail |/usr/bin/rt-mailgate --debug --queue rt_internal --action comment --url http://our.rt.instance /usr/bin/rt-mailgate: temp file is '/tmp/JxvCRVKXAJ/x3uMMQP32D' /usr/bin/rt-mailgate: connecting to http://our.rt.instance/REST/1.0/NoAuth/mail-gateway okTicket: 35348Queue: GeneralOwner: NobodyStatus: newSubject: testRequestor: me@some.domain # and of course the ticket is created as expected and I can see it in the RT web UI. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c2
--- Comment #2 from Nathan Cutler
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c3
--- Comment #3 from Darin Perusich
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c
Darin Perusich
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c4
Nathan Cutler
Does "ls -l `openssl x509 -hash -noout -in /etc/ssl/certs/Trust-Root.crt.pem`.0" return anything. If not have you tried running "update-ca-certificates -f" to recreate them?
No, the certificate chain is fine. The problem appears to be in the perl-Net-SSLeay package. When I install version 1.35-2.14 (from SLES11-SP3-Core repository), rt-mailgate works. However, when I install version 1.55-21.1 (from devel.lang.perl), it stops working. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c5
--- Comment #5 from Nathan Cutler
No, the certificate chain is fine. The problem appears to be in the perl-Net-SSLeay package. When I install version 1.35-2.14 (from SLES11-SP3-Core repository), rt-mailgate works. However, when I install version 1.55-21.1 (from devel.lang.perl), it stops working.
Just to clarify: the bug here is that rt-mailgate *hangs* with version 1.55-21.1 of perl-Net-SSLeay, while with version 1.35-2.14 of that package it generates an error message or successfully delivers the mail to RT (depending on what input I give it). BTW I did try the command you gave me: # cd /etc/ssl/certs # ls -l `openssl x509 -hash -noout -in /etc/ssl/certs/Trust-Root.crt.pem`.0 lrwxrwxrwx 1 root root 25 Oct 4 11:38 e801b2a2.0 -> Trust-Root.crt.pem (Actually, in my case the file is /etc/apache2/ssl.crt/Trust-Root.crt, but you get the idea.) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c6
--- Comment #6 from Darin Perusich
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c7
--- Comment #7 from Darin Perusich
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c8
--- Comment #8 from Darin Perusich
https://bugzilla.novell.com/show_bug.cgi?id=837513
https://bugzilla.novell.com/show_bug.cgi?id=837513#c9
--- Comment #9 from Nathan Cutler
What version of perl-LWP-Protocol-https are you running on the affected systems? The version in d:l:p, perl-LWP-Protocol-https-6.04-13.1 was causing this same problem for me on OpenSUSE 12.3, after downgrading to perl-LWP-Protocol-https-6.03-4.1.1 (vendor opensuse) the problem went away.
I currently have only one testing system, running RT 4.0.17 and SLE11-SP3. For testing I use this command: # echo "hello" | /usr/bin/rt-mailgate --debug --queue General --action correspond --ca-file /etc/ssl/certs/[our-Trust-Root].crt.pem --url https://[our.rt.instance] Here's what I'm getting as of today. Unfortunately, I can only test two of the four possible combinations, because SLE11-SP3 does not ship with the perl-LWP-Protocol-https package. 1st combination: perl-Net-SSLeay v. 1.55-24.1 (from d:l:p for SLE11-SP2) perl-LWP-Protocol-https v. 6.04-13.3 (from d:l:p) RESULT: broken (hangs) 2nd combination: perl-Net-SSLeay v. 1.35-2.14 (from SLES11-SP3 repository) perl-LWP-Protocol-https v. 6.04-13.3 (from d:l:p for SLE11-SP2) RESULT: works ("Could not load a valid user") 3rd combination: perl-Net-SSLeay v. 1.55-24.1 (from d:l:p for SLE11-SP2) perl-LWP-Protocol-https v. ??? (from SLES11-SP3 repository) RESULT: could not test because package is missing 4th combination: perl-Net-SSLeay v. 1.35-2.14 (from SLES11-SP3 repository) perl-LWP-Protocol-https v. ??? (from SLES11-SP3 repository) RESULT: could not test because package is missing Hope this helps. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com