Faucet v 1.10.4 "SSL WRONG VERSION NUMBER" #4084
Comments
lhchang
changed the title
|
Thanks for reporting this! Please would you try the self signed example at https://eventlet.net/doc/ssl.html? We'll also investigate. |
|
Thanks anarkiwi. Client side: Running the Python code with our key/certs: |
|
I think you're getting this error because you're trying to connect to an SSL/TLS socket with a plain-text connection. Can you try using openssl s_client instead of nc to talk to your encrypted socket listening on port 8443:
|
|
Ah you are right, thanks for the suggestion. Heres my output when using openssl s_client On the server side: Is this indicating the cert itself maybe missing something? |
|
Sounds like there is a mismatch in ciphers between your version of openssl and pyopenssl/eventlet. I tried running the test code below with python 3.8.10 on ubuntu 20.04, using eventlet==0.33.1 and pyOpenSSL==22.0.0: https://gist.github.com/gizmoguy/0372afad6e34170a693751859e3c0302 And it worked fine, could you confirm what version of linux you are using and your python / python library versions?: |
|
On our local machine using the eventlet example, it looks like we are running Python3.8, Ubuntu 20.04.1. The Faucet container seems to be using Python3.9, at least for 1.10.4. |
|
For your local machine running the eventlet example can you try upgrading to ubuntu 20.04.4? This is what I am using here and it works fine. |
|
I can confirm that using another generated cert that I can get the same results as your example output, but still not with the cert/keys we had on hand which were generated from another controller. We tried pivoting a bit to see if we could get Faucet to talk TLS with OVS using the process described in https://docs.openvswitch.org/en/latest/howto/ssl/, we get the following output. Not sure if this is a related issue but it doesn't seem like the process stays up when fed the certs/keys from OVS PKI. Ideally we would like to get this to work with our original switch but if there is something I missed with the OVS method hopefully that may help with our original problem? |
|
That log doesn't have the error that occurred, what is in your |
|
Found the issue, had another instance running at the time. However after resolving that I am running back into another SSL issue: This is using certs/keys generated from the OVS PKI tutorial |
|
What are you using to connect to the SSL/TLS port of faucet? netcat? openssl s_client? an openflow dataplane? Have you checked whatever client you are using is correctly configured to speak SSL/TLS rather than plaintext? |
|
In the context of my previous comment we were attempting to use Open vSwitch to connect to Faucet. In the context of the original issue, we were trying to connect a physical OpenFlow switch to Faucet using certificates/keys pulled from another SDN controller that we had originally adopted the switches with. We had only used openssl s_client/netcat to test the Python eventlet code that was linked before. |
|
Can you try using |
Hello. We are trying to run Faucet in our Kubernetes cluster (v 1.10.4) and running into issues when trying to load the certs/private keys. We are running Faucet with the following args:
--ryu-ctl-privkey /etc/ryu/ssl/ControllerCertPrivateKey.pem --ryu-ctl-cert /etc/ryu/ssl/ControllerCert.pem --ryu-ca-certs /etc/ryu/ssl/RootCAcert.pemThese were different versus the ones in this example (https://docs.faucet.nz/en/1.10.4/installation.html?highlight=ssl#additional-arguments) but that was what was available in the listed available args. After running, we encounter this error.
Some things we have tried:
openssl x509 -in ControllerCert.pem -text -nooutopenssl pkey -in ControllerCertPrivateKey.pem -pubout -outform pem | sha256sumandopenssl x509 -in ControllerCert.pem -pubkey -noout -outform pem | sha256sumThank you
The text was updated successfully, but these errors were encountered: